Skip to content
MrIvoryMrIvory
Connect processor Merchant panel

Trust

PCI checklist

Sandbox gateway. Not PCI DSS certified. Not a QSA attestation. A QSA must assess this environment before anyone may claim certification or an AOC. No existing attestation covers this droplet or this code.

A Level 1 pass is an annual report signed by a QSA, plus quarterly scans. Nobody here can sign that. Do not put “PCI DSS Level 1” on this site until that paper exists for this stack.

Already on this box

  • Card numbers and CVV only hit the card service. The panel rejects them.
  • After classify, PAN and CVV are dropped. Disk keeps CARD_MASK and a sandbox tok_… id, not a scheme token.
  • Logs strip card fields. Error pages do not echo PAN.
  • Node listens on localhost. nginx is the public door on port 80. 8080 and 8081 stay closed.
  • Card routes go to the card process. Everything else goes to the panel.
  • 3DS is a labeled sandbox click-through, with an empty slot for a later certified 3DS Server. Not real Visa 3DS.

We do next

  • Hostname + HTTPS. This sandbox is served at https://mrivory.com. Do not put it on reddragon.ae. Keep TLS on, and do not send cardholder traffic over plain HTTP on the hostname.
  • Second VPS for the card service. Today both pieces share one small droplet, so a QSA treats the whole box as a card environment.
  • Stop using a JSON file as the store. Locked database, backups, access control. Still no PAN on disk.
  • Access. Unique users, panel authenticator 2FA (Settings → Two-factor authentication), MFA on the server, shorter sessions. Not PCI certified.
  • Logs a QSA can read. Time, who, what, no card data.
  • Live cards stay off until the card service is on its own machine.

Later — ops, schemes, QSA

  • WAF in front.
  • Quarterly ASV scan.
  • Annual pentest.
  • Change-detect on the card host.
  • Written policies and a training record. A QSA will ask.
  • Certified 3DS Server (EMVCo-listed product) plus scheme sign-up. License it, don’t write the protocol.
  • Service-provider Level 1 ROC and AOC from a QSA. Every year.

How Level 1 actually works

Visa and Mastercard treat a gateway as a service provider. Level 1 is the top tier. We scope the card environment, close the gaps above, then hire a QSA. They test the live environment and write the report.

Back to overview