PCI DSS Compliance
Become PCI DSS compliant in days, not months.
Card numbers never touch your systems. We capture and vault them in an isolated, PCI DSS compliant form, so your scope shrinks to almost nothing.
Months vs days
The difference is who touches the card.
When card numbers pass through your systems, all of PCI DSS applies to you. When they never do, very little of it does.
Handling cards yourself
months- All 12 PCI DSS requirement areas apply to the systems that touch cards.
- Quarterly external vulnerability scans by an approved scanning vendor.
- Annual penetration tests and segmentation testing.
- Key management, encryption and access controls for stored cards.
- A Report on Compliance with a QSA once your volume requires it.
With Orchestrapay
days- Embed our hosted card form. Card numbers never reach your systems.
- We carry the card form, the vault, script integrity and tamper monitoring.
- Your own scope shrinks to how you embed the form.
- Most merchants in this setup can self-assess with SAQ A, the shortest questionnaire.
- Saved cards stay usable on every processor you route to.
What we carry for you
The controls that keep card data out of your scope.
Isolated card form
Cards are typed into a form served from its own domain, embedded in your checkout. Your page never holds the card number.
Scripts locked by hash
The card form loads no third-party scripts, and every script it runs is pinned by hash, as PCI DSS 6.4.3 requires.
Tamper monitoring
A separate monitor watches the payment page for changes, the control PCI DSS 11.6.1 asks for.
Encrypted vault
Card numbers are stored with AES-256-GCM and versioned keys. A record cannot be written without the key.
Masked from logs
Card numbers, security codes and expiry dates are masked before anything is logged, including any long number in any field.
Security code never kept
The CVV is used once to authorise the payment, then dropped. It is never stored.
How it works
Three steps out of scope.
Embed the card form
Drop the Orchestrapay payment form into your checkout with the React SDK or our hosted page.
Move stored cards
If you hold cards today, we coordinate their import into your vault with your current processor, then you delete your copy.
Self-assess
With no card data in your systems, complete the short self-assessment your acquirer asks for and file your attestation.
Questions teams ask before they switch.
Every business that accepts cards still has to validate compliance. What changes is how much of PCI DSS applies to you: with card capture and storage handled by Orchestrapay, your own systems stay out of scope and the validation is far shorter.
Show us your checkout. We will show you what drops out of scope.
Tell us how you take and store cards today. We will map what moves to us, what is left for you, and how long the switch takes.
- Card data off your servers
- Stored cards migrated for you
- A transparent number before you sign anything