PCI DSS & payment security
Your QSA asks the questions. We build the controls that answer them: segmentation, logging, vulnerability scanning, hardening, change control and payment-page protection.
We implement and evidence the technical controls of PCI DSS 4.0.1 for payment companies, fintechs and merchants that handle card data or host payment pages. We are not a QSA and do not certify; we make your assessment go smoothly. Projects start at €4,500 and usually take 2–4 weeks.
We read your last assessment or SAQ, map the card-data flows and list the technical gaps.
A fixed-scope plan in priority order, agreed with you and, if you like, with your QSA.
Controls built as code through pull requests: segmentation, logging, scanning, hardening, script monitoring.
Screenshots, configs, reports and runbooks collected per requirement, and a walkthrough for your team.
Most companies already have the policies. What they lack is technical evidence that the controls work: logs that are actually collected and reviewed, scans that run on schedule with archived results, segmentation that exists in the firewall and not only in a diagram. That is engineering work, and it is what we do.
Since 31 March 2025, requirements 6.4.3 and 11.6.1 apply to any page that collects card data or loads a payment form. A typical checkout loads analytics, chat widgets, A/B testing and tag managers. Each one can be modified to skim card numbers. We help you:
Controls are built as code: Terraform for network boundaries, Ansible or a Packer golden image for hardening, Git pull requests for every change. This makes the evidence easy. The history of the repository shows who changed what, when, and who approved it.
We do not perform the assessment, sign a Report on Compliance or issue an Attestation of Compliance. We work alongside your QSA, not instead of them.
A European fintech processing payments, cards and crypto, with 20–50 people and a regulated core. We lead its DevOps over the long term: infrastructure as code, PCI DSS controls, payments connectivity and disaster recovery.
We can build and evidence the technical controls, which is most of the engineering work. Compliance is confirmed by your QSA (or by your self-assessment questionnaire). We are not a QSA and we do not issue certificates.
6.4.3: you must keep an inventory of every script running on your payment page, with a reason for each, and confirm each is authorised and unchanged. 11.6.1: you must detect unauthorised changes to the page and its security headers. Both have been mandatory since 31 March 2025. We set up the inventory, the approval process and the change detection.
From €4,500 excluding VAT for a focused set of controls. A larger environment with many systems in scope costs more, and the fixed quote says exactly why.
Usually 2–4 weeks for the technical controls. If your assessment date is fixed, tell us on the first call and we will plan backwards from it.
Yes. Our engineers led DevOps for a European payments and card-processing fintech: Terraform on AWS and EKS, a Wazuh SIEM, scheduled vulnerability scanning, WAF, HSM connectivity over a private link and card-scheme connectivity. See the case study.
No. We work with your current hosting: AWS, other clouds, dedicated servers or a mix. The controls matter, not the provider.
Send us your last findings or a short description of your setup. We will tell you what we would fix first and what it would cost.