We access only what control testing requires
The PCIOasis agent works only at the configuration and metadata layer. It cannot access PANs, CVVs, or payment transaction data.
| Data Type | Collected | Notes |
|---|---|---|
| Primary Account Numbers (PAN) | Never | Agent operates at the configuration layer only |
| CVV / CVC codes | Never | No payment transaction interception |
| Firewall configuration state | Yes | Rule sets and change history for PCI Req 1 |
| Access control lists and user roles | Yes | Role names and permission states, not credentials |
| Patch and software version state | Yes | Package versions and patch status for Req 6 |
| Log retention configuration | Yes | Retention policy config for Req 10, no log contents |
| Authentication configuration | Yes | MFA state, session timeout config for Req 8 |
| Network topology metadata | Yes | Segment boundaries and flow rules, no traffic contents |
Controls for collected data
Encryption in Transit
Data exchanged between the PCIOasis agent and platform uses TLS 1.2+. Weak cipher suites are disabled, and certificate pinning protects agent-to-platform connections.
Encryption at Rest
Agent-collected configuration metadata is encrypted at rest with AES-256. A dedicated key management service manages the keys using hardware-backed storage.
Access Controls
RBAC limits each team member's visibility and actions. MFA is mandatory for every account. Session tokens expire and cannot be reused.
Monitoring and Logging
Access to customer environment data is logged. The internal audit trail remains separate from the customer evidence store and is available to security reviewers on request.
Network Isolation
Customer environments are logically isolated. The agent connects outbound only from within your network perimeter, so inbound ports are not required.
Vulnerability Management
The platform and agent undergo continuous vulnerability scanning. Critical patches are applied within 72 hours, and an internal responsible disclosure program supports security researchers.
Our current security program
We state our program status directly and do not represent incomplete certifications as finished.
Internal Security Program
Formal policies, incident response, and quarterly access control reviews are active.
Annual Penetration Testing
An independent security firm performs penetration testing annually. Findings remain tracked through resolution.
Vendor Risk Reviews
Third-party vendors with customer data access undergo security review before onboarding and again each year.
SOC 2 Type I Audit
The SOC 2 Type I audit is in progress and currently in evidence collection. The report is not yet complete.
SOC 2 Type II
SOC 2 Type II is planned for the 12-month period after Type I completion. Enterprise customers may request early Type I report access under NDA.
Security inquiry: Enterprise prospects may request a security questionnaire response or schedule a technical review call with our Head of Security. Contact [email protected] with the subject "Security Review."
Data retention periods
| Data Category | Retention Period | Purpose |
|---|---|---|
| CDE configuration snapshots | Active subscription + 90 days | Required for trending, evidence packaging, and audit history |
| Scan results and findings | Active subscription + 90 days | Audit evidence and posture history |
| Account and user records | Active subscription + 30 days | Account administration and billing |
| Platform access logs | 12 months | Security review and incident investigation |
After your subscription ends, data is soft-deleted immediately and permanently purged within 90 days. Longer retention is available on Enterprise plans. See our Privacy Policy for full details.
Questions about our security posture?
Our security team can explain how PCIOasis handles data from your environment.