Trust
PCI checklist
Sandbox gateway. Not PCI DSS certified. Not a QSA attestation. A QSA must assess this environment before anyone may claim certification or an AOC. No existing attestation covers this droplet or this code.
A Level 1 pass is an annual report signed by a QSA, plus quarterly scans. Nobody here can sign that. Do not put “PCI DSS Level 1” on this site until that paper exists for this stack.
Already on this box
- Card numbers and CVV only hit the card service. The panel rejects them.
- After classify, PAN and CVV are dropped. Disk keeps
CARD_MASKand a sandboxtok_…id, not a scheme token. - Logs strip card fields. Error pages do not echo PAN.
- Node listens on localhost. nginx is the public door on port 80. 8080 and 8081 stay closed.
- Card routes go to the card process. Everything else goes to the panel.
- 3DS is a labeled sandbox click-through, with an empty slot for a later certified 3DS Server. Not real Visa 3DS.
We do next
- Hostname + HTTPS. This sandbox is served at https://mrivory.com. Do not put it on reddragon.ae. Keep TLS on, and do not send cardholder traffic over plain HTTP on the hostname.
- Second VPS for the card service. Today both pieces share one small droplet, so a QSA treats the whole box as a card environment.
- Stop using a JSON file as the store. Locked database, backups, access control. Still no PAN on disk.
- Access. Unique users, panel authenticator 2FA (Settings → Two-factor authentication), MFA on the server, shorter sessions. Not PCI certified.
- Logs a QSA can read. Time, who, what, no card data.
- Live cards stay off until the card service is on its own machine.
Later — ops, schemes, QSA
- WAF in front.
- Quarterly ASV scan.
- Annual pentest.
- Change-detect on the card host.
- Written policies and a training record. A QSA will ask.
- Certified 3DS Server (EMVCo-listed product) plus scheme sign-up. License it, don’t write the protocol.
- Service-provider Level 1 ROC and AOC from a QSA. Every year.
How Level 1 actually works
Visa and Mastercard treat a gateway as a service provider. Level 1 is the top tier. We scope the card environment, close the gaps above, then hire a QSA. They test the live environment and write the report.