Security and compliance
Security and compliance at PCI Booking
What we are certified for, what it means for your own audit, and the documents we can send your security team.
PCI DSS Level 1
PCI DSS v4
ISO 27001:2022
Certifications
PCI DSS
Level 1 service provider
PCI DSS service provider since 2016, on version 4 since December 2023. Assessed against v4.0.1 by a Qualified Security Assessor, valid to 8 December 2026.
ISO/IEC 27001:2022
Certified by Amtivo
Our information security is certified to ISO/IEC 27001:2022 by Amtivo, valid to 12 February 2028.
Also: 3DS2. We support PSD2 Strong Customer Authentication through 3D Secure.
The PCI DSS certificate shows our assessment result. It does not replace our Attestation of Compliance, which we send on request.
Your scope
What this means for your PCI DSS scope
PCI Booking keeps card data out of your systems, which reduces your PCI DSS scope and simplifies your annual audit.
What our assessment covers
The card data we store, process and send on for you. The Shared Responsibility Matrix sets out which PCI DSS requirements PCI Booking meets and which stay with you.
Who still audits
Your business still has its own PCI DSS assessment each year: a Self-Assessment Questionnaire or an assessment by a Qualified Security Assessor, depending on your level. We will tell you what stays in scope for your setup. Reduce PCI DSS scope
Evidence on request
Documents for your security team and assessor
We send these to you or your assessor when you ask.
Attestation of Compliance
Our current PCI DSS Attestation of Compliance as a Level 1 service provider.
Shared Responsibility Matrix
Which PCI DSS requirements PCI Booking covers and which stay with you.
SAQ D whitepaper
A whitepaper written by a Qualified Security Assessor on SAQ D for businesses that use PCI Booking.
How data is protected
Card data stays in the vault. You control who can use it.
Tokens in your systems, not cards
Your systems store a token for each card. The card itself stays with us, and is used only when you send the token with an instruction.
Access controls you set
Every request made with your account is checked against the controls you choose:
- IP restrictions: requests only from addresses you list
- Destination whitelisting: cards go only where you have approved
Hosting and data protection
Storage region and GDPR
Storage region
Cards are stored in the region you choose, to meet local rules.
GDPR
PCI Booking Ltd is based in Dublin, Ireland, and processes personal data in line with the EU General Data Protection Regulation. GDPR at PCI Booking
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.