Case Study: Reducing PCI Scope for a SaaS Payment Platform

By redesigning card data flows and introducing tokenization, we helped a SaaS platform cut the number of in-scope systems by more than half.

A growing SaaS payment platform asked us to help reduce the cost and effort of its annual assessment.

Approach

  1. Full inventory of systems that store, process or transmit card data
  2. Tokenization for card data at rest
  3. Network segmentation between the payment zone and the rest of the platform

Outcome

The number of systems in scope dropped by more than half, and the next assessment took significantly less time.