Book a demo
Trust Center · Card data

PCI DSS Level 1,
assessed every
year.

Card data lives in a segmented, independently assessed environment. Your apps and systems never touch a full card number.

Request the AoCTalk to security
PCI DSS v4.0.1 · Service provider Level 1

12 of 12 requirements in place and independently assessed

  • Network 2
  • Data 2
  • Software 2
  • Access 3
  • Monitoring 2
  • Policy 1

Annual assessment

  1. Mar 2024 Assessment
  2. Mar 2025 Assessment
  3. Mar 2026 AoC issued
  4. Mar 2027 Next assessment
Qualified Security Assessor AoC · Mar 2026
The standard

Twelve requirements. Six goals. All
in scope.

How each requirement is met in our cardholder data environment.

Secure network

  1. Network security controls Default-deny firewalls around the CDE.
  2. Secure configurations Hardened images, no vendor defaults.

Protect account data

  1. Protect stored data Tokenised PANs, keys in HSMs.
  2. Encrypt in transit TLS 1.2+ on every connection.

Vulnerability management

  1. Malware protection Endpoint protection on all systems.
  2. Secure software Code review and SAST in every pipeline.

Access control

  1. Need to know Least privilege by role.
  2. Identify & authenticate SSO with MFA for all access.
  3. Physical access Certified data centres only.

Monitor & test

  1. Log & monitor Central, tamper-evident logging.
  2. Test regularly Quarterly ASV scans, annual pen tests.

Policy

  1. Security policy Maintained policies, training, IR plan.
Scope reduction

Your apps never see a card number.

Card numbers are tokenised the moment they enter the platform. Only the vault - inside our assessed environment - can use them.

  1. Out of scope Your app Shows •••• 4223
  2. Our CDE Tokeniser PAN → tok_4f9a…
  3. Our CDE Card vault Encrypted, keys in HSMs
  4. Network Card scheme Authorisation & clearing
Evidence

For your assessors.

Shared under NDA with customers and banks in due diligence.

Found a vulnerability?

Email security@corebankos.com - monitored around the clock. We acknowledge within 24 hours.

Book a security reviewReport an issue