Payment Security and PCI
Approved Scanning Vendor
An Approved Scanning Vendor (ASV) is authorized by PCI SSC to perform external vulnerability scans required by PCI DSS programs.
Read full definitionShouldEye Trust Intelligence Glossary
Payment Security and PCI Terms
PCI DSS, SAQ levels, P2PE, tokenization vaults, and payment-security controls — educational, not certification advice.
Educational information only. ShouldEye does not provide legal, banking, or individualized financial advice. Dispute rights, deadlines, and outcomes depend on your payment method, card network, issuer, processor, jurisdiction, and the facts of your case. Legal Disclaimers
35 published definitions in this topic.
Payment Security and PCI
Business Continuity
Business continuity keeps critical payment and commerce operations running through disruptions.
Read full definitionPayment Security and PCI
Client-Side Encryption
Client-side encryption encrypts payment fields in the browser or app before they reach the merchant’s servers.
Read full definitionPayment Security and PCI
Data Security Incident
A data security incident is a suspected or confirmed event that threatens the confidentiality, integrity, or availability of data.
Read full definitionPayment Security and PCI
Disaster Recovery
Disaster recovery is the plan and capability to restore payment systems after a major outage or site loss.
Read full definitionPayment Security and PCI
Encryption at Rest
Encryption at rest protects stored payment data using cryptography while it sits on disk or in databases.
Read full definitionPayment Security and PCI
Encryption in Transit
Encryption in transit protects payment data as it moves across networks, typically via TLS.
Read full definitionPayment Security and PCI
End-to-End Encryption
End-to-end encryption in payments means card data is encrypted from capture toward the processor so intermediaries cannot read PANs.
Read full definitionPayment Security and PCI
Hardware Security Module
A hardware security module (HSM) is hardened hardware that protects cryptographic keys used in payment encryption and tokenization.
Read full definitionPayment Security and PCI
Hosted Payment Fields
Hosted payment fields are card inputs served by a payment provider inside a merchant checkout so card data goes to the provider.
Read full definitionPayment Security and PCI
Hosted Payment Page
A hosted payment page is a payment provider–hosted checkout the customer is redirected to or shown for card capture.
Read full definitionPayment Security and PCI
ISO 27001
ISO/IEC 27001 is an international standard for establishing and managing an information security management system (ISMS).
Read full definitionPayment Security and PCI
Key Rotation
Key rotation is replacing cryptographic keys on a schedule or after events to limit exposure.
Read full definitionPayment Security and PCI
Payment Data Breach
A payment data breach is unauthorized access to or exfiltration of cardholder or sensitive payment data.
Read full definitionPayment Security and PCI
Payment Data Retention
Payment data retention is how long payment records and cardholder data elements are kept.
Read full definitionPayment Security and PCI
Payment Iframe
A payment iframe embeds a provider’s card-entry frame on the merchant site.
Read full definitionPayment Security and PCI
Payment System Availability
Payment system availability is the ability of authorization and checkout systems to accept payments when expected.
Read full definitionPayment Security and PCIRegulation
PCI DSS
PCI DSS is the Payment Card Industry Data Security Standard for protecting cardholder data when it is stored, processed, or transmitted.
Read full definitionPayment Security and PCI
PCI DSS 4.0.1
PCI DSS 4.0.1 is a revision of the PCI Data Security Standard in the v4.x line published by the PCI SSC.
Read full definitionPayment Security and PCI
PCI Level 1
PCI Level 1 is a merchant (or service-provider) validation tier commonly used by brands/acquirers based largely on annual transaction volume and sometimes incident history.
Read full definitionPayment Security and PCI
PCI Level 2
PCI Level 2 is a merchant (or service-provider) validation tier commonly used by brands/acquirers based largely on annual transaction volume and sometimes incident history.
Read full definitionPayment Security and PCI
PCI Level 3
PCI Level 3 is a merchant (or service-provider) validation tier commonly used by brands/acquirers based largely on annual transaction volume and sometimes incident history.
Read full definitionPayment Security and PCI
PCI Level 4
PCI Level 4 is a merchant (or service-provider) validation tier commonly used by brands/acquirers based largely on annual transaction volume and sometimes incident history.
Read full definitionPayment Security and PCI
PCI Scope
PCI scope is the set of people, processes, and technologies that store, process, or transmit cardholder data or can affect its security.
Read full definitionPayment Security and PCI
PCI Scope Reduction
PCI scope reduction means architecting payments so fewer systems touch cardholder data.
Read full definitionPayment Security and PCI
Penetration Testing
Penetration testing is simulated attack testing to find exploitable weaknesses in systems or applications.
Read full definitionPayment Security and PCI
Point-to-Point Encryption
Point-to-Point Encryption (P2PE) encrypts card data at the capture device until decryption in a secure environment.
Read full definitionPayment Security and PCI
Qualified Security Assessor
A Qualified Security Assessor (QSA) is a PCI SSC-approved company qualified to assess PCI DSS compliance.
Read full definitionPayment Security and PCI
SAQ A
SAQ A is a PCI self-assessment questionnaire aimed at merchants that fully outsource card-data functions to validated third parties with no electronic card data in their environment.
Read full definitionPayment Security and PCI
SAQ A-EP
SAQ A-EP covers e-commerce merchants who outsource payment processing but whose websites can still affect the security of the payment page.
Read full definitionPayment Security and PCI
SAQ D
SAQ D is the most comprehensive self-assessment questionnaire for merchants or service providers not eligible for shorter SAQs.
Read full definitionPayment Security and PCI
Self-Assessment Questionnaire
A Self-Assessment Questionnaire (SAQ) is a PCI SSC questionnaire used by eligible entities to self-validate PCI DSS controls.
Read full definitionPayment Security and PCI
SOC 2 Type II
SOC 2 Type II is an attestation report on how well an organization’s controls operated over a period against Trust Services Criteria.
Read full definitionPayment Security and PCI
Token Vault
A token vault stores payment tokens mapped to underlying credentials in a hardened service.
Read full definitionPayment Security and PCI
Vulnerability Assessment
A vulnerability assessment identifies known security weaknesses, often via authenticated or external scans.
Read full definition