Quickstart: Implement Zero-Scope Payments
Set up client tokenization, enforce TLS 1.3, configure PCI profile, launch secure sessions, capture signed audit logs, prepare your SAQ — the full implementation in 6 steps, in under 30 minutes.
Implement Client-Side Tokenization
| Gateway | Client SDK | Token format |
|---|---|---|
| **Stripe** | Stripe Elements / Stripe.js | `tok_...` / `pm_...` |
| **Adyen** | Adyen Web Components / Drop-in | `encrypted-payload` |
| **Braintree** | Hosted Fields / Drop-in | `nonce-tok_...` |
| **Square** | Square Web Payments SDK | `cnon:...` |
| **Worldpay** | Worldpay Tokenize.js | `wp_token_...` |
Configure TLS Load Balancer
PCI-DSS 4.0 requires TLS 1.3 (TLS 1.2 deprecated). Configure your load balancer + verify:
AWS ALB:
bash
aws elbv2 modify-listener \
--listener-arn arn:aws:elasticloadbalancing:... \
--ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06
Nginx reverse proxy:
nginx
ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256;
ssl_prefer_server_ciphers off;
ssl_ecdh_curve X25519:secp521r1:secp384r1;
Cloudflare: Dashboard → SSL/TLS → Edge Certificates → Minimum TLS Version → 1.3. Enable 0-RTT for performance.
Verify the enforcement before going live:
bash
openssl s_client -connect api.acme.com:443 -tls1_3 # Should succeed
openssl s_client -connect api.acme.com:443 -tls1_1 # Should fail
Enable the PCI Compliance Profile
| Control | What it blocks |
|---|---|
| **AI provider allowlist** | Only PCI-attested providers (e.g., AWS Bedrock, AWS Polly) |
| **Raw card data validation** | Reject any payload looking like raw PAN / CVV |
| **Audit log signing** | HMAC-SHA256 on every PCI-relevant event |
| **Recording encryption** | AES-256-GCM mandatory on all session recordings |
| **Voice transcription scrubbing** | Real-time CVV / PAN detection + redaction in transcripts |
| **Sub-processor allowlist** | Non-PCI-attested providers blocked from PHI / PCI data |
| **Retention enforcement** | 365-day max retention on PCI-tagged records |
| **Disposable evidence** | All PCI exports watermarked with viewer identity |
Launch a PCI-Profile Session
For real-time use cases (support call where customer mentions card info, healthcare-finance crossover), launch a PCI-tagged session.
typescript
const session = await aeion.api.post("/api/realtime/sessions", {
type: "retail_support",
scope: "private",
complianceProfile: "pci", // 🔒 The magic string
resourceRef: {
module: "commerce",
collection: "orders",
id: "ord_123",
},
participants: [
{ role: "agent", userId: "support_tier_2" },
{ role: "customer", userId: "guest_user" },
],
enableRecording: true, // AES-256-GCM auto-applied
enableTranscription: true, // CVV / PAN scrubbing auto-applied
});
What changes vs default sessions:
- AI transcription routed to PCI-attested providers only (AWS Bedrock + Polly)
- Recording encryption mandatory at AES-256-GCM with per-tenant rotating keys
- CVV / PAN detection runs in real-time on the transcript stream — matched patterns scrubbed before storage
- Audit log signing active — every action HMAC-SHA256 stamped
Voice scrubbing in action:
Customer audio: "...my card number is four-two-four-two-four-two-four-two..."
Transcript stored: "...my card number is [REDACTED-PAN-LIKELY]..."
Monitor Audit-Signed Logs
Every PCI-relevant action writes to the audit log with HMAC-SHA256 integrity signing.
Per-row integrity:
typescript
{
id: "audit_xyz789",
timestamp: "2026-05-20T14:23:00.123Z",
actor: "user_alice",
action: "view_payment_method",
resource: { module: "billing", id: "pm_abc" },
outcome: "success",
complianceProfile: "pci",
integrity: {
hash: "sha256:abc123...",
previousHash: "sha256:def456...", // Chain to previous entry
signature: "hmac-sha256:...",
keyVersion: "key_v3", // Key rotation tracking
chainVerified: true,
},
}
Daily verification cron:
- Background job recomputes integrity hashes for the previous day
- Any mismatch fires a critical alert (potential tampering)
- Key rotation every 90 days; previous keys retained for verification
SIEM export — push to Splunk / DataDog / Sumo Logic / Elastic. Real-time stream + historical query both supported.
Integrity report: Admin → Security → Integrity Report shows verification status + any flagged anomalies. Audit-ready for SAQ submission.
Prepare Your SAQ
| Level | When applicable | Annual effort |
|---|---|---|
| **SAQ-A** | Card data never touches your servers (fully outsourced) | Several hours |
| **SAQ-A-EP** | E-commerce, redirect or iframe-hosted card capture | 1-2 days |
| **SAQ-B** | Imprint / dial-out only | 2-3 days |
| **SAQ-C** | Internet-connected POS systems | 5-10 days |
| **SAQ-D** | Everything not covered by other SAQs | 30-90 days |
| **ROC** | Mandatory for Level 1 merchants (>6M tx/year) | 90-180 days |
Integration Recipes
Commerce → PCI checkout. Configure Commerce to use a tokenizing gateway. Iframe-hosted card capture means your tenant never touches raw card data — SAQ scope drops to SAQ-A-EP.
Realtime → PCI sessions. Customer-support calls flagged as PCI when discussing payment issues. Aeion routes audio through PCI-attested transcription + applies real-time scrubbing.
Billing → subscription PCI compliance. Recurring billing tokenizes the card at first capture; tokens stored in the gateway (not Aeion). Subsequent charges reference tokens — Aeion still never sees raw card data.
Governance → PCI audit log retention. PCI-tagged audit logs retain for minimum 1 year per PCI-DSS req 10.7. Aeion's audit log honors this automatically.
Sentinel → PCI anomaly detection. Sentinel monitors PCI-tagged events for unusual patterns (mass-export attempts, off-hours access, unfamiliar admin actions). Surfaces high-severity events to security team.
Cross-jurisdictional compliance. Stack pci with gdpr-strict for EU merchants. Both profiles enforce simultaneously; stricter rule wins on conflicts.
Troubleshooting
Tokenization failing in iframe. Common causes: (1) iframe loaded over HTTP instead of HTTPS, (2) CSP blocking the gateway's iframe, (3) third-party cookie blocking. Test with the gateway's native test cards in sandbox mode first.
TLS 1.3 verification failing. Use the gateway provider's TLS verification tool (Stripe's test page, Adyen's TLS verifier, SSL Labs). Common: outdated load balancer config preferring TLS 1.2.
Real-time scrubbing missing a number. Review the transcript in Admin → Realtime → Sessions → [session] → Transcript. Wipe the specific transcript row + recording media manually. Tighten the regex pattern + log a Forge issue for the security team. The Remediation Runbook details the procedure.
Audit log integrity check failing. Critical — investigate immediately. Check Admin → Security → Integrity Report. Causes: signing key rotation hiccup (auto-resolves), storage corruption (restore from Aegis), or intentional tampering (incident response — preserve evidence, escalate).
SAQ wizard asks about a control I don't have. Suggests "Not Applicable" with evidence pointer. If unsure, leave as N/A with documented reason. Your QSA verifies on assessment.
Quarterly ASV scan flagged a vulnerability. Most common: outdated TLS configuration, weak cipher suite, missing security header. Aeion auto-fixes via the security-update cron; rescan after the fix lands.
Frequently Asked Questions
No. Use `default` or `gdpr-strict`. The pci profile is resource-intensive due to aggressive encryption, logging, provider restrictions. Only use when a session is directly adjacent to the Cardholder Data Environment (CDE).
Follow the Remediation Runbook — surgical delete endpoints to wipe the specific transcript row + source recording media file, alert platform team to harden the regex. Incident logged + reported to QSA per PCI Req 12.10.
No — Aeion provides the technical enforcement controls necessary to PASS an audit, but the deployment operator owns their own PCI-DSS validation (SAQ submission, Quarterly ASV scans). Aeion makes the audit feasible; you still own the acquirer + QSA relationship.
Yes — last-4 and BIN are not in PCI scope (PCI-DSS Req 3.4 exclusions). Aeion's Commerce module tracks last-4 + BIN for fraud detection + display purposes. Stored unencrypted but with audit log on access.
PIN data is in PCI-PIN scope (different standard). Aeion does not currently support PIN-debit flows — use signature-debit only. For PIN-debit, integrate a third-party PED device directly to your gateway.
3DS happens in the gateway's hosted iframe. Aeion receives the authenticated token. The 3DS challenge is invisible to Aeion — entirely between the issuer and the cardholder.
Yes — Strong Customer Authentication compliance handled by the gateway. Aeion's frontend SDKs surface the 3DS challenge automatically. Recurring transactions can use MIT (Merchant Initiated Transactions) exemption when appropriately flagged.
Significantly lower. Custom PCI implementations cost $100K-$500K + 1 FTE-year. Aeion's pre-built controls + audit log + automated SAQ wizard reduce that to days-of-effort + the ASV scan fee (~$1K-$5K/year).
Yes. Migration plan: (1) integrate Aeion-hosted iframe alongside existing system, (2) parallel-run for a billing cycle, (3) cut over once tokens validated. Singularity has connectors for Stripe / Adyen migration. Most migrations complete in 4-8 weeks.
Aeion's architecture is designed to keep its own infrastructure out of the Cardholder Data Environment in the first place, so it doesn't carry a Level 1 ROC the way a company that touches raw card data would. The tokenization providers (Stripe, Adyen, Square, etc.) hold their own PCI-DSS Level 1 certification for the CDE they operate. Aeion's own infrastructure undergoes independent security testing — quarterly internal penetration tests and annual external ASV scans — and documentation is available to your QSA on request.