Security

Security is foundational.

Built to PCI DSS v4.0.1 requirements: AES-256-GCM96 encryption via HashiCorp Vault Transit, TLS 1.3 everywhere, and an AWS multi-account architecture where the cardholder data environment never touches anything else.

PCI DSS v4.0.1 Ready AES-256-GCM96 EU-only data residency
Controls

Six layers of defense.

Defense in depth is not a checklist — it is an architecture. Each control is independent; a failure in one layer does not compromise the others.

Tokenization

All PANs are tokenized via HashiCorp Vault Transit before storage. AES-256-GCM96 encryption — keys never leave the Vault boundary. Only UUID tokens circulate outside the CDE.

Network segmentation

The cardholder data environment is isolated in a dedicated VPC. Non-PCI services run in a separate AWS account. CDE-to-non-CDE traffic is denied at the network ACL level.

Encryption everywhere

AES-256 at rest, TLS 1.3 mandatory in transit. Internal service-to-service calls are authenticated and encrypted. No TLS 1.0 or 1.1 — protocol downgrade is blocked at the ALB.

Access control

MFA enforced for all AWS console access via IAM Identity Center. Least-privilege IAM roles per service. No long-lived static credentials — OIDC token exchange only in CI/CD.

Monitoring & detection

AWS GuardDuty, SecurityHub, and CloudTrail active across all accounts. Alerts route to the security team in real time. API call logs are immutable in the log-archive account.

Key management

AWS KMS with HSM-backed keys for infrastructure encryption. Vault Transit keys rotate every 90 days. Key material is never exported. Rotation events are audited and logged.

Architecture

From internet to vault.

Every payment request passes through multiple security boundaries before card data is ever touched. The path is deterministic and fully auditable.

Request path

  1. Internet

    TLS 1.3 termination at the edge. HTTP/2 only. Cipher suites restricted to AEAD.

  2. ModSecurity WAF

    OWASP Core Rule Set. Blocks SQLi, XSS, and scanner traffic before it reaches application code.

  3. Traefik → ALB

    Layer-7 routing with mTLS between internal services. Non-PCI traffic never reaches the CDE network segment.

  4. Payment core (CDE)

    Isolated VPC, dedicated AWS account, no internet egress except whitelisted PSP endpoints.

  5. HashiCorp Vault Transit

    PAN tokenized immediately on receipt. Plaintext never written to disk. UUID token returned to the caller.

  6. Aurora PostgreSQL

    AES-256 at rest, automated PITR backups, storage encrypted via AWS KMS. Only ciphertext and UUID tokens are stored.

Key principles

  • EU-only data residency

    All infrastructure runs in AWS eu-central-1 (Frankfurt). No cross-region replication of cardholder data.

  • HSM-backed keys

    AWS KMS with CloudHSM-backed key material. Keys are generated in hardware; the plaintext key never exists in software.

  • Multi-account AWS isolation

    Separate AWS accounts for management, PCI workloads, non-PCI workloads, and log archive. IAM boundaries enforced at account level.

  • Zero-trust between services

    Every service-to-service call is authenticated (RSA signature + replay protection or Bearer token). No implicit trust based on network adjacency.

Questions about our architecture or requesting security documentation?

Contact security team