Trust Center

How PCI Monitor protects your data, who helps us handle it, and the documents we can share.

How we protect your data

We never hold card data

PCI Monitor does not store, process or transmit cardholder data. The optional card-field check uses a published test card number, never a real card.

Payments are handled by Stripe

Subscription payments are taken by Stripe, a PCI DSS Level 1 service provider. Card details go to Stripe and are not entered on PCI Monitor.

Your data stays separate

Every company sees only its own monitors, results and reports. A partner sees only the clients it manages.

Protected sign-in

Passwords are stored only as one-way hashes. Each person signs in with a code sent by email or text, or from an authenticator app, and a session ends after 8 hours.

Encryption

Data travels over encrypted connections. Logins and keys that customers give us for monitoring are stored encrypted, and customer API keys are kept only as hashes.

You decide, and it is recorded

Script decisions, consents and changes are recorded with who did them and when, in an audit log each company can read.

Roles and least access

Administrator and read-only roles limit what each person can change. Support access to a company is limited to what the company allows.

Hosted on Amazon Web Services

PCI Monitor runs on Amazon Web Services in the United States (Oregon). Access to the servers is by individually authenticated staff only.

Security measures

The controls that are running today. We list only what is in place, and we add to this page as more is done.

  • Two-step sign-in Every sign-in needs a second step: a code sent by email or text message, or an authenticator app.
  • Sign-in attempt limits Failed sign-ins are limited (10 per account or 30 per address in 15 minutes), and an unknown email and a wrong password get the same answer.
  • Password rules Passwords must have at least 12 characters, very common ones are refused, and they are stored only as one-way hashes.
  • Session protection Sessions end after 8 hours or at sign-out. The session cookie cannot be read by page scripts, is never sent from another website, and travels only over HTTPS.
  • Staff access to the cloud Our own access to the cloud account is through single sign-on with multi-factor authentication, and there are no long-lived access keys on personal computers.
  • Separation between companies Every company sees only its own data. Before launch we tested the application's routes for access across companies and found none.
  • Encryption in transit All connections are encrypted (HTTPS), including the connection from the application to its database, whose identity is verified.
  • Encryption at rest The database and the storage for our software releases are encrypted at rest.
  • Stored logins and keys Logins and keys that customers give us are stored encrypted, with a key kept apart from the database. Customer API keys are stored only as hashes.
  • Backups The database is backed up automatically, and the backups are kept for 35 days.
  • Browser protections The site sends modern browser protections: strict transport security (HSTS), a content security policy, and rules against framing and content sniffing.
  • Cross-site request check A request that changes data is refused when it comes from another website.
  • Address checks Web addresses that customers ask us to monitor are checked: internal and private network addresses are refused, so the service cannot be pointed at our own systems.
  • Error messages In production, error messages never reveal internal details.
  • Vulnerability scan The software we ship is checked every week against public lists of known vulnerabilities, and any finding is sent to us by email.
  • Private servers The servers have no public address. Visitors reach them only through the load balancer, and we administer them through an authenticated AWS session, with no open remote-login ports.
  • Network rules The database is on a private network, and network rules allow each part only the traffic it needs.
  • Sandboxed test browser The browser that runs customers' tests is sandboxed and cannot reach our internal network or the cloud's metadata service.
  • Automatic updates Security updates for the servers' operating system are installed automatically every day.
  • Monitoring and alarms AWS CloudTrail records activity in our cloud account, GuardDuty watches for threats, and automatic alarms email us when the site is unhealthy.