Show where payment data goes.

Start with the cardholder data environment. Vambrace helps you establish the relevant scope, control ownership and evidence for the validation route that applies to your organisation.

Who owns each part of a hosted checkout?

A shopper selects Pay on the merchant’s site and is redirected to a provider-hosted payment page.

Illustrative payment boundary

Merchant: Trace the website and redirect configuration that the merchant controls. Record the payment flow to the hosted page.
Provider: Ask for a current Attestation of Compliance covering the service purchased, plus a statement of which controls each party operates.
Validation: Take the payment flow and provider evidence to the acquirer or assessor to confirm the applicable validation route.

Read the service guide (PDF) ↗ · PCI SSC guidance on provider evidence

Engagement scope

Prepare for the applicable validation route

Trace the payment journey

Document where account data enters, moves through and leaves the business. Include hosted payment pages, payment providers and systems that could affect the security of the cardholder data environment.

Define responsibilities

Identify controls operated by the business and those performed by a provider. Review the relevant scope of provider evidence and assign an owner for any remaining gap.

Confirm the validation route

Confirm the reporting method with your acquiring bank or payment brand. Apply the eligibility criteria for the relevant Self-Assessment Questionnaire (SAQ), or arrange an assessment documented in a Report on Compliance (ROC) where required. A qualified assessor can help establish technical scope.

Which payment channels and service providers are in scope for your next validation?

Discuss PCI DSS readiness ↗