PCI DSS
How card data is handled
Where card data goes
Card numbers for VxCloud billing are handled by Stripe and PayPal. Please contact us before placing your own cardholder data on the platform.
Overview
PCI DSS is the security standard for organizations that store, process, or transmit payment card data.
When you pay for VxCloud, card numbers and CVVs go to Stripe or PayPal, and we keep only your provider choice, masked identifiers, and billing address. If your own application handles cardholder data, you remain responsible for its PCI DSS scope, so please talk to us before running it on VxCloud.
What's included
Production-grade capabilities, ready to enable in your workspace.
Multi-factor authentication
Accounts can require a time-based one-time code at sign-in.
OAuth sign-in
Sign in with an existing identity provider account instead of another password.
Secrets in HashiCorp Vault
Credentials are kept in Vault rather than in application configuration.
Audit console
Activity is recorded so it can be reviewed later, behind an MFA check.
Encryption in transit
Public VxCloud endpoints are served over HTTPS.
Card data stays with providers
Card numbers for VxCloud billing are handled by Stripe and PayPal, not stored by us.
Frequently asked questions
Still have questions? Our enterprise team answers within one business day.
No. Card numbers and CVVs are handled by Stripe and PayPal.
Related enterprise capabilities
Ready to move forward with PCI DSS?
Talk to our enterprise team — we'll scope your requirements, map the right capabilities, and build a rollout plan tailored to your organization.