Payment Card Industry · Data Security Standard
topropay holds the regulated card-data surface so your stack stays clean. Hosted capture, HSM-backed tokenisation, 3-D Secure 2 and signed audit trails deliver payment card industry data security standard PCI DSS compliance from a single integration — for online checkouts, mobile apps, subscriptions, marketplaces and PSPs.
The short version
Card schemes hold every merchant to the same security baseline. The PCI DSS payment card industry data security standard turns that baseline into twelve requirement groups. They cover network segmentation, key custody, access logging and incident response. Failure is costly. You face fines, scheme penalties and forced fixes. And when a breach hits the news, the loss of trust outlasts the technical repair.
For most teams, the hard part is that PCI DSS is not a one-off project. It is a constant duty. It touches infrastructure, code, vendors and people. topropay was built to absorb that duty. We capture card data inside our environment and hand your systems opaque tokens. Your scope stays small, and your engineers stay focused on the product — not on holding a Cardholder Data Environment together.
That split of duties matters at every stage. Think of the first audit before launch, the yearly renewal, a new market, or the move from one acquirer to many. It matters again the day a breach elsewhere in the industry forces every merchant to check its posture. With a hosted PCI DSS payment layer in place, those moments become paperwork and configuration, not emergency engineering. The control surface the assessor cares about most already sits inside a service built, monitored and certified to handle it. Your team keeps shipping the product. The compliance work that once ruled the roadmap becomes a steady, predictable line item.
Key benefits
Card data leaves your perimeter. The regulated workload moves into ours. The audit shifts from proving your infrastructure to a short paperwork exercise. Concretely:
Card data is captured inside our tokenisation vault. Your own systems never store, process or transmit raw card numbers. That shrinks the surface an assessor has to review. The payment card industry data security standard PCI DSS check becomes a routine task, not a project.
Plug into dozens of acquirers and 300+ methods behind one integration. Whichever bank clears the payment, the PCI DSS payment controls stay the same — encryption, tokenisation, logging and key rotation.
Strong Customer Authentication fires per transaction wherever the market and risk profile call for it. PSD2 and the card schemes' own authentication rules land inside the platform, not on your engineers' backlog.
Every PCI-relevant event is signed, time-stamped and exportable. Your QSA can verify controls without trawling production servers. Evidence is a download, not a hunt.
How it works
Four stages, all inside our compliant boundary. Your stack only ever sees tokens, results and evidence — never live card numbers.
Your checkout hands off card entry to a hosted field served from our PCI DSS payment gateway domain. The card number goes straight into the vault — never your DOM, never your logs.
The PAN is swapped for a token. From that point on, every system — including yours — uses the token. Card data in transit is TLS-encrypted end to end across the platform.
The platform routes the token to the chosen acquirer with 3DS2 / SCA applied per transaction. Authorisation, capture and refunds all happen against the token, not the live PAN.
Signed event logs, key-rotation records and access reports stream into one console. Your QSA pulls evidence directly — no production access required.
The twelve requirements
The Council’s twelve requirement groups are the spine of payment card industry data security standards PCI DSS work. We map each one to a concrete control on our side. The matrix below the chips shows what your QSA will see in the Responsibility Matrix.
Some requirements are shared. “Restrict access by need-to-know,” for example, applies on both sides of the integration. For those, we hand over a clear control template, so your half is easy to complete. For the buyer-facing summary of this work see the payment card industry PCI compliance page; for card-flow specifics see credit card payment processor.
Features
A single payment platform with security primitives built in, not bolted on. Every row maps to one or more of the twelve requirements.
| Capability | Control delivered | PCI DSS mapping |
|---|---|---|
| Tokenisation vault | Format-preserving tokens | Req. 3, 4 |
| Encryption | TLS 1.2+ in transit · AES-256 at rest | Req. 3, 4 |
| Key management | HSM-backed key custody & rotation | Req. 3 |
| Access control | RBAC, MFA, just-in-time elevation | Req. 7, 8 |
| Logging & monitoring | Signed, time-stamped event stream | Req. 10, 11 |
| Authentication | 3-D Secure 2 + SCA per transaction | PSD2 / scheme |
| Network security | Segmented CDE, change-controlled | Req. 1, 2 |
| Vulnerability mgmt | Continuous scanning + penetration tests | Req. 6, 11 |
Where it fits
One compliant boundary covers many ways customers pay. A handful of the most common shapes:
A hosted card field keeps your e-commerce site out of PCI scope while still feeling native to the brand. Most merchants qualify for SAQ A — the shortest assessment available.
A native SDK captures card data inside our boundary on iOS and Android, then returns a token. The app handles a token, the platform handles the regulated data.
Tokens persist across renewals, so subscriptions, free-trial conversions and saved-card flows reuse the vaulted credential without ever touching the raw PAN.
Platforms reselling payments inherit our controls for every sub-merchant onboarded, with isolation between tenants and per-tenant reporting.
Agent-assisted payments use pause-and-resume DTMF capture or a virtual terminal that drops the call recording out of PCI scope.
Send a hosted payment link from your billing system. The shopper enters card data on our domain; you receive a confirmation and a token.
Industry relevance
The control set is the same — how it lands in your business depends on what you sell. A short tour through the patterns we see most often:
Trust signals
The platform is assessed annually and operated under a documented control framework. What that means in practice:
Cardholder Data Environment is segmented, change-controlled and reviewed against the current Payment Card Industry Data Security Standards PCI DSS — independent assessment by an external QSA.
European card flows apply Strong Customer Authentication per transaction; out-of-scope exemptions are claimed only where the risk score supports them.
Data is processed under EU data-protection rules, with regional residency options for merchants whose own programmes require them.
Access control, change management, vulnerability scanning and incident response run under processes mapped to recognised security frameworks alongside PCI DSS.
Common questions
It is the global security baseline for any business that stores, processes or transmits cardholder data. The PCI Security Standards Council maintains it. The standard defines twelve requirement groups. They cover network security, cryptography, access control, monitoring and policy. Any merchant that accepts cards is bound to it by contract through the card schemes.
topropay holds the regulated card-data surface so you do not have to. Cards are captured in our hosted fields or SDK, tokenised, and processed against acquirers. Raw card numbers never cross into your environment. Most merchants who integrate us qualify for SAQ A, the shortest PCI DSS payment card industry data security standard self-assessment. The rest reach SAQ A-EP at most.
Yes, in the sense that the platform performs the functions of a PCI DSS payment gateway — capturing card data inside a compliant boundary, tokenising it, and forwarding tokens to acquiring banks for authorisation. It goes beyond a single gateway by orchestrating routing across many acquirers, but the gateway-layer obligations under the payment card industry data security standards PCI DSS sit with us.
A complete PCI DSS payment solution covers card capture (hosted fields or an SDK), tokenisation, encrypted transmission, authorisation against acquirers, key management, logging and reporting, and an auditor-friendly evidence trail. topropay delivers all of these from one integration so you do not assemble PCI controls from separate vendors.
A PCI DSS payment application is software that handles card data outside a hosted-field model — for example, a point-of-sale terminal app or a card-present client. If you build one, you take on PA-DSS / PCI Secure Software responsibilities yourself. topropay’s hosted capture and SDK model is designed to keep payment-application scope on our side and out of yours.
For most online merchants using our hosted card field, the assessed scope is SAQ A — roughly two dozen questions confirming you redirect or iframe card capture to a compliant service. Merchants who customise the field further may land on SAQ A-EP. We can map your specific flow against the current PCI DSS payment card industry assessment criteria during onboarding.
Yes. 3DS2 and SCA run per transaction with a risk-based exemption strategy, satisfying PSD2 in Europe and the equivalent scheme mandates elsewhere. Authentication results, exemption claims and liability shifts are all recorded against the transaction.
Inside our tokenisation vault, in encrypted form, with keys held in dedicated HSM clusters. Customers receive opaque tokens; raw card numbers are accessible only to internal services that absolutely require them — and only through audited, signed access paths.
We provide an Attestation of Compliance you can hand to your assessor, plus an evidence package covering tokenisation, encryption and logging on our side of the responsibility matrix. For your own side, the platform exports signed event logs, access reports and authentication records — turning the audit interview into a document review.
It is built for scale. The same vault, key custody and routing engine that serve a single merchant serve payment service providers handling sub-merchant flows for thousands of customers. Per-tenant tokenisation and isolated reporting keep each book of business compliant on its own terms.
Send us your current payment flow. We map it against the twelve requirements, mark the parts we can absorb, and scope a hosted-capture rollout that puts you on SAQ A — typically in a few weeks, without changing your acquirer contracts.