Global · PCI DSS
Payment Card Industry Data Security Standard
PCI DSS applies wherever cardholder data is stored, processed or transmitted. The best control is often not touching card data at all — RuleFix helps keep it out of your systems.
Example finding
rulefix scan --format json
{
"rule": "pci-dss.card-numbers",
"framework": "PCI DSS",
"severity": "high",
"file": "app/api/signup.ts",
"check": "Card numbers in logs or databases",
"status": "failed",
"fix": { "available": true, "files": 2 }
}Key requirements
What PCI DSS expects from engineering.
- 01
Protect stored account data
Minimise storage and render the primary account number unreadable where stored.
- 02
No sensitive auth data
Never store CVV, full track data or PINs after authorisation.
- 03
Strong cryptography in transit
Encrypt cardholder data across open, public networks.
- 04
Secure development
Develop software securely and address common coding vulnerabilities.
- 05
Logging
Log and monitor all access to system components and cardholder data.
- 06
Strong authentication
Use MFA for access into the cardholder data environment.
What RuleFix checks
Turned into code rules.
- Card numbers in logs or databases
- CVV persistence
- Tokenised payment flows
- Insecure transport
- Admin routes without MFA
Official sources
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
Other frameworks
Cover more with the same workflow.
DPDP
GDPR
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.