Aeion Commerce Security Architecture
Where cardholder data lives (it doesn't — tokenization at the gateway means Aeion never touches card numbers), how fraud detection routes risk to Stripe Radar + 3DS escalation, what's encrypted at rest, and how the order audit log maps to PCI DSS evidence requirements.
Compliance Inventory
PCI DSS
Aeion Commerce never stores cardholder data — gateway tokenization keeps the cardholder data environment (CDE) at the gateway, not in Aeion's database. Reduces your PCI scope to SAQ-A (the easiest PCI level).
Encryption at rest
AES-256-GCM for payment provider API keys and webhook secrets.
Encryption in transit
TLS 1.2+ to all 20 payment gateway endpoints; TLS 1.3 preferred; mTLS supported.
Fraud detection
AI-driven Loss Prevention scoring + Stripe Radar integration + 3DS escalation on high-risk orders.
Order audit log
Every order records every state transition. 1-year retention (configurable).
PII handling
customer PII (email, phone, address) encrypted via tenant-scoped encryption keys.
Backup integrity
Orders and payment configuration covered by Aegis continuous backup — immutable storage with S3 Object Lock.
The PCI Scope Argument
PCI DSS scope is the single biggest security driver for commerce architecture. The fewer systems handle cardholder data (card number, full track data, CVV), the smaller your PCI scope, the cheaper your audit.
Fraud Detection — AI + Gateway Integration
Fraud detection in Aeion Commerce is a two-layer defense:
What's Encrypted At Rest
| Data class | Encryption |
Order Audit Log
Every order state transition is recorded with full provenance and the underlying transition reason.
Compliance Mapping
| Framework | Control | Aeion Commerce evidence |
FAQ
Aeion handles orders but not cardholder data. Cardholder data is tokenized client-side via the gateway's SDK (Stripe.js, PayPal SDK); the token is what reaches Aeion. PCI explicitly scopes out systems that handle only tokens — they're not the cardholder data environment. Result: SAQ-A scope, the smallest PCI assessment.
Don't. The scope expansion + audit cost increase is severe (SAQ-D + likely Level 1 audit). If a use case requires it, talk to the Aeion team about a dedicated isolated deployment with appropriate segmentation.
Yes — Aeion supports adding a custom payment provider through the same integration pattern as the 20 existing ones. Talk to your account team for custom-provider onboarding.
It sends a minimal feature set (account age, prior order count, country tier, score signals) — not raw email / address / card data. PII redaction is configurable per-tenant.
Customer data is queryable + deletable per-tenant. Aegis's time-travel feature supports point-in-time recovery for "the customer asked us to delete X but reverted that request" scenarios.
Every payment gateway webhook is signature-verified using an encrypted webhook secret. Invalid signatures are rejected before any state mutation.