PCI DSS & Payment Data with LLMs

• Annual on-site security assessment by Qualified Security Assessor (QSA)
• Quarterly network scans by Approved Scanning Vendor (ASV)
• Attestation of Compliance (AOC) required

• Annual Self-Assessment Questionnaire (SAQ)
• Quarterly network scans by ASV
• May require on-site assessment depending on card brand

• Annual Self-Assessment Questionnaire (SAQ)
• Quarterly network scans by ASV

• Annual Self-Assessment Questionnaire (SAQ) may be required
• Compliance requirements set by merchant bank

🎯 Recommended Architecture: Fully Outsourced

Use hosted payment pages or client-side tokenization so CHD never touches your servers:

• Stripe Checkout: Customer enters card on Stripe's page, you receive only a payment intent ID
• PayPal Commerce Platform: Customer stays on your site but payment fields are in PayPal iframes
• Square Web SDK: Card data collected in Square-controlled fields, SDK returns nonce

Result: Your PCI scope is reduced to SAQ A (22 questions) instead of SAQ D (300+ questions)

⚠️ Higher Scope: Direct POST to Payment Gateway

If payment form is on your domain but POSTs directly to payment gateway (not your server):

• CHD passes through your website (in browser) but not your server
• Still in-scope for PCI: SAQ A-EP (approximately 150 questions)
• Must ensure no JavaScript logs or caches CHD

❌ Highest Scope: CHD Touches Your Server

If your server receives, processes, or stores CHD (even briefly):

• Full PCI DSS compliance required: SAQ D (300+ questions) or on-site audit
• Network segmentation, encryption at rest, penetration testing, etc.
• Quarterly vulnerability scans by Approved Scanning Vendor
• NEVER send this data to LLM services

1. Input Validation and Filtering

Detect and redact potential CHD before sending to LLM:

function sanitizeForLLM($text) {
    // Redact potential credit card numbers (Luhn algorithm check)
    $text = preg_replace_callback('/\b\d{13,19}\b/', function($match) {
        if (isValidLuhn($match[0])) {
            return '[REDACTED-CARD]';
        }
        return $match[0];
    }, $text);

    // Redact potential CVV codes
    $text = preg_replace('/\b(cvv|cvc|security code)[\s:]*\d{3,4}\b/i', '[REDACTED-CVV]', $text);

    return $text;
}

2. Error Message Sanitization

Never include CHD in error logs or messages sent to LLMs for analysis:

3. Support Ticket Screening

If using LLMs to categorize or route support tickets, scan for CHD first:

• Detect card number patterns (13-19 digits, Luhn algorithm validation)
• Flag keywords like "CVV", "security code", "card number", "expiration"
• Quarantine tickets containing potential CHD for human review only
• Train support staff to NEVER include full card details in tickets

4. Database Query Result Filtering

If LLMs analyze query results, ensure CHD columns are excluded:

-- ❌ DON'T: Select all columns
SELECT * FROM payments WHERE customer_id = 123;

-- ✅ DO: Explicitly exclude CHD
SELECT
    payment_id,
    amount,
    status,
    CONCAT('****', RIGHT(card_token, 4)) as card_display,
    created_at
FROM payments
WHERE customer_id = 123;

Build and Maintain a Secure Network

Req 1: Install and maintain network security controls

Req 2: Apply secure configurations to all system components

Protect Cardholder Data

Req 3: Protect stored account data

Req 4: Protect cardholder data with strong cryptography during transmission

Maintain a Vulnerability Management Program

Req 5: Protect all systems and networks from malicious software

Req 6: Develop and maintain secure systems and software

Implement Strong Access Control Measures

Req 7: Restrict access to system components and cardholder data by business need to know

Req 8: Identify users and authenticate access to system components

Req 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Req 10: Log and monitor all access to system components and cardholder data

Req 11: Test security of systems and networks regularly

Maintain an Information Security Policy

Req 12: Support information security with organizational policies and programs