Use case summary
Customers enter card details on Corefy's hosted checkout or in embedded fields, so the data never reaches your infrastructure. What your systems hold is a token. Corefy's platform is certified PCI DSS Level 1 and audited annually by an independent QSA. Result: your own validation covers a much smaller environment than one that processes card data.
- Developers & CTO
- Payment Ops
Why PCI cost is decided by your architecture
PCI DSS applies to any system that stores, processes, or transmits cardholder data, and to everything connected to it. That set of systems is your cardholder data environment, and its size decides what you have to build, document, and prove every year.
A single design decision can change that size dramatically. Taking card numbers in your own form puts your servers, your logs, your backups, and anything that can reach them inside the scope. Keeping the data off your infrastructure leaves far less to secure and far less to evidence.
Teams often discover this after the fact, when the annual validation arrives, and the environment that has to pass it turns out to include half the estate.
How to keep card data outside your environment
The practical goal is to hold no card data at all. Everything below serves that: the card is captured, secured, and stored on Corefy's side, and your systems work with a reference to it.
- 1
Capture card data where it is already in scope
Customers enter card details on Corefy's hosted checkout page or in embedded fields you place inside your own interface. In both cases, the data goes to Corefy and does not reach your infrastructure.
- 2
Keep a token, not a card number
Card data is replaced with a token that stands in for it on later payments. Your database stores the token, which has no value to an attacker outside your payment setup, and repeat or recurring charges run from it.
- 3
Rely on platform controls you would otherwise build
Encryption in transit and at rest, cryptographic key management, network segmentation that isolates the PCI zone, continuous security monitoring, and vulnerability management are part of the platform rather than a program your team runs.
- 4
Verify what arrives from the platform
Webhooks are signed, so your system can confirm that a payment notification came from Corefy and was not altered on the way.
- 5
Control who can see and do what
Role-based access control governs what each user can access; actions are recorded with username and IP, and user accounts that stay inactive for 90 consecutive days are disabled automatically, as PCI DSS requires.
- 6
Have the evidence ready when someone asks
Corefy Ltd is certified as a PCI DSS Level 1 Service Provider, the strictest tier, and is assessed annually by an independent Qualified Security Assessor across development, infrastructure, management, support, and operations.
What you get
Card data sits in an environment audited to PCI DSS Level 1 every year.
A smaller annual validation
Most clients validate with a self-assessment questionnaire rather than building and auditing a cardholder data environment, because the card data sits on Corefy's side.
Engineering time back
Encryption, key management, segmentation, monitoring, and the evidence trail behind them are platform capabilities, so your engineers are not maintaining a compliance program alongside the product.
Access to providers that require a certified partner
Some acquirers only offer host-to-host merchant accounts to businesses operating inside a certified environment, which puts those rates and that coverage within reach.
An answer for enterprise procurement
When a large customer or partner asks how card data is handled, the answer is a Level 1 certification and a named audit scope, rather than a description of your own controls.
Level 1 is the tier that cannot be self-assessed
PCI DSS sorts organizations into four levels by card transaction volume, and Level 1 applies to organizations with over six million transactions a year. It is the only tier that cannot be validated by a questionnaire: it requires a Report on Compliance produced by an independent Qualified Security Assessor, plus quarterly network scans by an approved scanning vendor. Corefy is assessed at that level every year, across development, infrastructure, management, support, and operations. That audit covers the environment where your card data would otherwise sit.