Security Modules
Audit Scope Drop
By preventing credit card numbers from touching your application storage, we keep your backends completely out of PCI audit environments (CDE).
Interactive Compliance Checker
Select your payment integration pipeline below to instantly trace your required audit framework and dynamically highlight your custom compliance track.
Verified Track: SAQ-A (Lowest Compliance Scope)
Because all payment variables and interactions are fully hosted and managed on paytech.global servers, your system infrastructure has zero card data contact. Your annual self-assessment is streamlined from an exhaustive 300+ item audit track to just 22 basic administrative checkpoints.
1. Compliance Architecture & Scope Reduction Strategy
The definitive path to rapid compliance is total audit scope elimination. By decoupling raw card data from your servers, we keep you out of scope.
Core Security Mandate
Raw Primary Account Numbers (PAN) or Sensitive Authentication Data (SAD) must never enter or traverse tenant-controlled infrastructure. Any custom raw processing pipeline completely strips away scope reduction, exposing your organization to full compliance liabilities.
SAQ-A Track
Applicable for hosted links, pre-built QR checkouts, and fully external transactional gateways where 100% of CDE tasks are outsourced.
SAQ-A-EP Track
Applicable for in-line secure hosted element integrations where merchants preserve layout flow but data streams directly to our edge.
2. Cardholder Data Environment (CDE) Boundary
The definitive architectural dataflow map proving your infrastructure sits 100% outside of cardholder environments.
Customer Device
Captures Card inputsEncapsulates parameters inside client container
Secure Core vault
PayTech Level 1 NodeTrades parameters for non-reversible hash
Tenant App Server
No CDE - Non-ScopeStores safe token only for invoicing
Acquiring network
Acquirer EcosystemProcesses financial funds settlement
3. Shared Responsibility Compliance Matrix
Clear division of security controls mapping exactly who owns which standard validation, resolving auditor ambiguity.
| PCI-DSS v4.0 Layer | PayTech Global | Tenant Organization |
|---|---|---|
| Req 1: Network Security Controls | Full Ownership. Hardening firewalls and API load balancers. | Edge workstation access only. |
| Req 3: Cardholder Data Protection | Full Ownership. Hardware tokenization and AES-256 databases. | Proper token use without raw PAN replacement. |
4. The Compliance Evidence Pack
Download verifiable, pre-compiled security artifacts instantly and hand them directly to your Qualified Security Assessor (QSA).
Attestation of Compliance (AoC)
Downloadable executive summary verifying latest successful Level 1 annual external assessment.
Responsibility Letter
Official legal sign-off validating that the platform assumes full ownership of card data transactions.
5. Developer Secure Vault Tracing
Detailed integration trace parameters proving to auditors that card protection layers are baked into core code.
Initialize dynamic iframe containers directly from your frontend code. Raw sensitive credentials flow exclusively to our verified Level 1 nodes.
// 1. Initialize custom secure elements on customer web browser
import { loadPayTechSDK } from '@paytech-global/sdk-web';
const sdk = await loadPayTechSDK('pk_live_84729384729');
const elements = sdk.elements({
theme: 'dark-glassmorphic',
locale: 'en'
});
// 2. Mount highly secure input containers (completely out of tenant DOM scope)
const cardNumberElement = elements.create('cardNumber', {
placeholder: '•••• •••• •••• ••••',
style: {
base: { fontSize: '15px', color: '#10b981' }
}
});
cardNumberElement.mount('#card-number-container');
// 3. Trade secure input values for a non-reversible cryptographic Token
const payToken = await sdk.createToken(cardNumberElement);
// Output safe payload (PAN details never touch your infrastructure!)
console.log('Secure Token:', payToken.id); // "tok_9482739487"Ready to reduce your security scope?
Access and deploy hosted frame fields to securely process payments in less than 22 compliance questions.