Frameworks · PCI DSS
Coming soonPCI DSS v4.0.1 readiness
PCI DSS readiness is coming soon to TrustProof: it will take you through the 12 requirements of PCI DSS v4.0.1, scoped to how your business handles payment card data. TrustProof is not a Qualified Security Assessor: your acquiring bank or the card brands decide how you validate, and TrustProof will organise the evidence for that.
Key facts
What you can check
- All 12 requirements
- One item for each part of the 12 requirements, in TrustProof's own words with requirement numbers only.
- Scoped to how you take payments
- You will record whether card handling is fully outsourced, your website affects the payment page, you handle card data yourself, or you are a service provider. That decides which items you can set aside.
- No card data in TrustProof
- Never upload card numbers, security codes or other account data. TrustProof is not part of your cardholder data environment.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Will walk you through each requirement with plain-language questions
- Will record how you handle card data and the justification for anything set aside
- Will track scans, penetration tests, scope confirmations and your service provider register with review dates
- Will collect AWS evidence through a read-only role
- Will give your assessor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify and is not a Qualified Security Assessor or an Approved Scanning Vendor.
- It does not complete or submit your Self-Assessment Questionnaire or Attestation for you.
- TrustProof is not affiliated with or endorsed by the PCI Security Standards Council.
FAQ
Frequently asked questions
Our payments go through a hosted checkout. Does PCI DSS still apply?
Usually yes, but far less of it. Fully outsourced card handling typically means a short self-assessment. Your acquiring bank or payment provider confirms which validation applies to you.
Can TrustProof validate us?
No. Validation is a Self-Assessment Questionnaire or a Report on Compliance from a Qualified Security Assessor, as your acquirer or the card brands require. TrustProof organises the evidence.
Can we upload screenshots that show card data?
No. Never upload card numbers, security codes or other account data. Mask them first, or describe the evidence and keep the original in your cardholder data environment.
When will PCI DSS readiness be available?
It is coming soon. The free read-only AWS scan and One-Button Fix are available today. Talk to us if you would like to hear when it opens; this page will be updated when it does.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.