A small card-data environment
Only a few services ever see a card number. They run in a separate cloud account, isolated from the portal and everything else.
Security and compliance
Security, plainly.
How we protect card data, and where we stand on PCI DSS.
PCI DSS status: Level 1 service provider assessment in progress. We don't yet hold an Attestation of Compliance (AOC), and we'll only accept live card data once we do. Design partners get early access in the meantime.
Design
How we're building the vault.
Envelope encryption
Each card is encrypted with its own data key, which is protected by keys held in a hardware-backed key management service.
Random tokens
A token carries no information about the card and can't be reversed without the vault.
No card numbers in logs
Audit logs record who did what and when, never the card itself. We keep them for at least 12 months.
Infrastructure as code
Every change to the environment is reviewed and recorded.
Static IPs and mTLS
Fixed egress IPs so your PSPs can allowlist us, plus mutual TLS for endpoints that need it.
For your assessor
What it means for your PCI scope
If card numbers never reach your servers, your PCI DSS scope shrinks a lot. How much depends on how cards are captured. Hosted card fields, which we plan to offer, keep card entry off your pages. That can let merchants qualify for the shortest self-assessment (SAQ A). If you send card numbers to us server-to-server, your servers still handle them and your scope stays larger. Your own assessor makes the final call on your scope.
Data location
Card data will be stored in AWS Asia Pacific (Singapore), ap-southeast-1.
Your cards are yours
You can request a bulk export of your cards at any time, free of charge. We send them securely to your PSP or your next vault.