PCI-DSS Financial Compliance
Term 38 of 68 in the ERPStack technical glossary
What is PCI-DSS Financial Compliance?
The Payment Card Industry Data Security Standard (PCI-DSS) is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.
PCI-DSS Financial Compliance at a glance
- Standard
- PCI DSS v4.x, maintained by the PCI Security Standards Council
- Scope rule
- 100% of systems that store, process or transmit cardholder data fall inside the boundary
- Cheapest strategy
- Reduce scope to 0 stored card numbers using 1 tokenising payment provider
- Never store
- Sensitive authentication data after authorisation — including the 3-digit security code
- Key handling
- AES-256 encryption with keys held in a managed key service, rotated on a defined schedule
- Built with
- A tokenising provider in front of Next.js 16, 0 card numbers in PostgreSQL 18, AES-256 keys in AWS provisioned by Terraform, RBAC and SSO over admin paths, Sentry payloads scrubbed
- Numbers that matter
- PCI DSS v4.x; 0 stored card numbers is the cheapest scope; the 3-digit code must never be retained; AES-256 for anything that remains
- Adjacent regimes
- SOC 2, ISO 27001 and GDPR for the personal data alongside payments
- Commonly paired with
- AWS key management, a Virtual Private Cloud boundary, RBAC, SSO, Terraform provisioning, Semgrep SAST and OWASP ZAP scanning
- Scope arithmetic
- 1 tokenising provider removes the card number from your systems: 0 primary account numbers at rest, 0 retention of the 3-digit code after authorisation, and a token that is useless if exfiltrated.
- Clocks running beside it
- GDPR Article 33 gives 72 hours to report a breach of the personal data sitting next to the payment, and Article 12(3) gives 1 month to answer the cardholder asking what you hold.
- Surfaces to prove clean
- The ERP on PostgreSQL 18, a CRM holding the customer, Redis caches, a ClickHouse analytics database extract, Sentry payloads and AWS backups — 6 places that each have to show 0 stored card numbers.
How PCI-DSS Financial Compliance works in production
The ERPStack approach to PCI-DSS Financial Compliance
We design systems that minimize PCI-DSS audit scope by routing payment checkouts through tokenized gateways, keeping primary databases out of audit scope.
Frequently asked questions about PCI-DSS Financial Compliance
What does PCI-DSS Financial Compliance apply to?
Any system that stores, processes or transmits cardholder data. Financial Compliance under PCI DSS v4.x, maintained by the PCI Security Standards Council, covers the people, processes and technology inside that boundary. The single most consequential decision is therefore where the boundary sits, because everything inside it inherits the full control set and everything outside it does not.
How do you reduce PCI scope?
By never touching the card number. Using a payment provider whose hosted fields or SDK collect card data directly, returning a token your system stores instead, means the card number never enters your servers or logs. Financial Compliance effort collapses accordingly. The common mistake is a well-designed checkout that still posts card data through your own backend 'just for validation', which puts everything back in scope.
What must never be stored after authorisation?
Sensitive authentication data, including the card security code and full magnetic-stripe or chip data. Financial Compliance treats retention of these as a serious failure regardless of encryption, so they must not reach a database, a log line or an error report. That last one causes real incidents: an exception handler that serialises the whole request object can persist exactly the data the standard forbids keeping.
Does a compliant provider make your system compliant?
It reduces your obligations; it does not remove them. Financial Compliance still covers your network, access control, logging and change management for whatever remains in scope, and you remain responsible for how the integration is implemented. ERPStack builds payment integrations designed to keep card data out of your systems entirely — we hold no certification, and the assessment remains the merchant's.