Payments & Money APIs · Ledgers, Reconciliation & Risk
PCI DSS Scope, Tokenization & Payment Security
Keep card data out, secure what remains, and handle credentials safely.
PCI DSS v4.0.1 applies to anyone storing, processing or transmitting cardholder data (and systems that can affect it). Minimize scope: use PSP tokenization (store pm_…/tok_… references, never PANs), hosted/iframe fields, network segmentation, and no card data in logs, analytics or support tools. v4.0 adds requirements such as inventorying and authorizing payment-page scripts and tamper detection. Protect PSP secret keys (vault, restricted keys, rotation), verify webhooks, and require MFA for PSP dashboards — dashboard access can issue refunds and payouts.
What may be stored
| Data | Can you store it? | Notes |
|---|---|---|
| PAN (card number) | Only if PCI-compliant + protected | Avoid; use PSP tokens |
| CVV/CVC | Never after authorization | Not even encrypted |
| Expiry, cardholder name | With PAN protections | Usually unnecessary |
| PSP token / payment method ID | Yes | Not cardholder data |
| Last 4 + brand | Yes | For receipts/UI |
| PSP secret API key | In a secrets manager | Restricted keys, rotation |
Python (log scrubbing)
PAN_RE = re.compile(r"\b(?:\d[ -]?){13,19}\b")
def luhn_ok(digits: str) -> bool:
s, alt = 0, False
for d in reversed(digits):
n = int(d) * (2 if alt else 1)
s += n - 9 if n > 9 else n
alt = not alt
return s % 10 == 0
def scrub(text: str) -> str:
def mask(m):
digits = re.sub(r"[ -]", "", m.group(0))
return "[PAN REDACTED]" if luhn_ok(digits) else m.group(0)
return PAN_RE.sub(mask, text)
Common pitfalls
- Card numbers in support tickets, logs or chat transcripts.
- Unrestricted secret keys shared across services.
- Uncontrolled third-party scripts on checkout pages.
Key points
- Tokenize; never store CVV
- Minimize scope with hosted fields
- Protect keys and dashboards
Further reading: PCI DSS
Practice questions
Can you store CVV codes encrypted for faster repeat purchases?
Answer
No — PCI DSS forbids storing sensitive authentication data like CVV after authorization, even encrypted; use PSP tokens for repeat payments.
Why is PSP dashboard access a security concern?
Answer
Dashboard users can issue refunds, change payout bank accounts and export data, so it needs MFA, least privilege and audit.
Open in the app to mark lessons complete, take notes and track your progress.