Executive Summary: What is it?
The Payment Card Industry Data Security Standard (PCI DSS) is a global security framework mandated by the card networks that founded the PCI Security Standards Council (American Express, Discover, JCB, Mastercard and Visa) for any organization that stores, processes, or transmits cardholder data. Version 4.0.1 is the only active version: v3.2.1 was retired on 31 March 2024 and v4.0 on 31 December 2024. Critically, PCI DSS certifies the merchant environment, not the software itself. No tool ships as "PCI certified." What software can do is reduce how much of your environment falls within scope.
CFO / Business Impact: What does it cost/risk?
- Non-Negotiable for Payments: Any organization accepting card payments must comply. Non-compliance risks merchant account termination and full liability for breach costs. There is no opt-out.
- Scope is the Lever: The strategic finance decision is not "how do we comply" but "how do we minimize scope." An isolated payment vault (SAQ-A path) keeps cardholder data entirely off your infrastructure, which shrinks what you must validate. Whether a self-assessment questionnaire suffices or a Qualified Security Assessor (QSA) must assess you is set by your acquirer or the payment brands, not by PCI DSS.
Technical Reality: How does it work?
- Scope Tiers: Compliance requirements scale with how much cardholder data touches your systems. How compliance is validated (a self-assessment questionnaire such as SAQ A, or a Report on Compliance by a QSA) is set by the payment brands and acquirers in their own programs; the PCI Security Standards Council sets no validation duties.
- Cardholder Data Environment (CDE): Segmenting the CDE from the rest of your network can reduce how much of your network falls within PCI DSS v4.0.1 scope. Self-hosted payment orchestrators with an isolated vault component (e.g., Hyperswitch's vault architecture) achieve this by ensuring raw card data never enters the main application database.
- Key Controls: Stored card numbers (PAN) rendered unreadable (by strong cryptography of at least 112 bits of effective key strength, truncation, index tokens or one-way hashes), strong cryptography for PAN sent over open, public networks, RBAC with MFA on all CDE access, tamper-evident audit logging, and quarterly vulnerability scans by an Approved Scanning Vendor (ASV).
What the Label Means in a Solution Profile
PCI DSS applies to businesses that handle card data, not to software, and no tool is PCI compliant on its own.
- Self-Hosted line: No self-hosted line carries a PCI DSS label: self-hosting puts your own environment in scope.
- Managed service line: "PCI DSS (Audited)" means the vendor holds an Attestation of Compliance for its service, signed by a Qualified Security Assessor after a full assessment against version 4.0.1. "PCI DSS (Self-Assessed)" means it completed the service-provider self-assessment questionnaire (SAQ D) and its attestation. The label never carries a "Level": levels are payment-brand volume tiers, not part of the standard.