# PCI DSS Level 1 · Trust Center · CorebankOS

> Card data lives in a segmented, independently assessed environment. How CorebankOS meets the twelve PCI DSS requirements, and the evidence for your assessors.

Source: https://corebankos.com/trust-center/pci-dss

## PCI DSS Level 1, assessed every year.

Card data lives in a segmented, independently assessed environment. Your apps and systems never touch a full card number.

- **12** PCI DSS v4.0.1 · Service provider

## Twelve requirements. Six goals. All in scope.

How each requirement is met in our cardholder data environment.

### Secure network

- **Network security controls**: Default-deny firewalls around the CDE.
- **Secure configurations**: Hardened images, no vendor defaults.

### Protect account data

- **Protect stored data**: Tokenised PANs, keys in HSMs.
- **Encrypt in transit**: TLS 1.2+ on every connection.

### Vulnerability management

- **Malware protection**: Endpoint protection on all systems.
- **Secure software**: Code review and SAST in every pipeline.

### Access control

- **Need to know**: Least privilege by role.
- **Identify & authenticate**: SSO with MFA for all access.
- **Physical access**: Certified data centres only.

### Monitor & test

- **Log & monitor**: Central, tamper-evident logging.
- **Test regularly**: Quarterly ASV scans, annual pen tests.

### Policy

- **Security policy**: Maintained policies, training, IR plan.

## Your apps never see a card number.

Card numbers are tokenised the moment they enter the platform. Only the vault - inside our assessed environment - can use them.

- **Your app**: Shows •••• 4223
- **Tokeniser**: PAN → tok_4f9a…
- **Card vault**: Encrypted, keys in HSMs
- **Card scheme**: Authorisation & clearing

## For your assessors.

Shared under NDA with customers and banks in due diligence.

- Attestation of Compliance
- Responsibility matrix
- Penetration test summary
- Security policy overview

## Found a vulnerability?

Email security@corebankos.com - monitored around the clock. We acknowledge within 24 hours.