Solutions
Card data on a private network. PCI scope you can draw.
Payment teams, acquirers and merchant platforms that must attest against PCI DSS v4.0.1 and want the cardholder data environment small enough to draw on one page.
Why now
Every merchant now attests against the full PCI standard.
PCI DSS v4.0.1 is fully in force
Its future-dated requirements became mandatory on 31 March 2025, so every merchant now attests against the full standard, including client-side script controls and stronger authentication. [1]
SourcePCI Security Standards Council, PCI DSS v4.0.1; future-dated requirements mandatory from March 31, 2025. The full citation and link are in the footer notes.
What it means for you
Your assessor now checks the whole standard, and the size of what you must prove is the size of the network your card data can reach.
What waiting costs
A failed or qualified attestation means remediation under deadline and a conversation with the bank no CFO wants. What you must prove is the size of your network.
Why Triple X
Triple X gives card-handling workloads their own private network with nothing reachable unless you publish it, which keeps the PCI scope small and the evidence simple. Operator access is logged; the SOC 2 report is available under NDA.
In plain English
The card brands raised the bar on 31 March 2025 and your assessor now checks everything. Running your payment stack on its own private network, with no exit fee, is the cheapest way to make the scope small enough to pass.
What you get
Four things, each a product you can open.
One private network per customer
The cardholder data environment lives inside it. Ingress is published only for the domains you allow.
OpenDatabases private by default
PostgreSQL 17, three nodes, restore to any second in seven days, on a private endpoint.
OpenTerminals and devices you own
Run on Triple X Cloud Nodes in the store or on our nodes; the same private cloud either way.
OpenSealed for the data no human may read
Processing where no operator can read card data in use.
Open
Which way in
Start where it fits. Move later without a new vendor.
Triple X Cloud nodes
No hardware of your own. Join the waitlist and start when your seat opens.
Your own devices
Triple X connects your racks or devices to a private cloud of your own.
Both
Sensitive work on your devices, the rest on ours, one private cloud.
Objections you will hear
What someone in the room will say.
Is the platform PCI certified?
The attestation behind the platform is a SOC 2 Type II report, available under NDA. It is not a PCI Attestation of Compliance. The controls above are what keep your scope small; your assessor scopes your environment.
Who else can see transaction data?
Nobody outside your private cloud. The platform sees that a workload exists and how big it is, not what is in it. Sealed closes the in-use gap where you need it.
What happens when a store’s line drops?
A Triple X Cloud Node in the store keeps working locally and syncs when the line returns. Your records live on the device first.
What does it cost?
Hourly, published, no minimum term. Processing is quoted separately, in writing, before you sign.
What yes looks like
The list a buyer brings to the table.
- The cardholder data environment on one private network you can draw
- Databases that are never public unless you choose it
- A written statement of what the platform can and cannot see
- Devices in the store that keep working offline
- One hourly bill and no exit fee
- An assessor who can read the controls, not a brochure
Get started
Draw your scope with us.
Bring your assessor to the first call.
- 01
Join the waitlist.
Tell us what you want to run and where. No credit card.
TakesTwo minutes
- 02
Run the pilot.
Ten nodes, 60 days, a pass mark you set in writing.
Takes60 days
- 03
Decide on day 60.
Extend, or leave at the transfer rate and nothing else.
WhoYou
We never ask for your root credentials, API keys or bank details by email.
The first 60 days
A pilot with a pass mark you set.
One store or one merchant segment, the assessor on the first call, the scope drawn before the first transaction.
Week 1
Your private cloud, private network, one database
Create your private cloud, its private network and a PostgreSQL 17 database on a private endpoint. Draw the cardholder data environment boundary with your assessor on the same call.
Weeks 2 to 4
The authorisation path, for real
Run the authorisation path for one store or one segment. Cut the store's line on purpose and watch the node sync when it returns. The pass mark is yours: a scope the assessor will accept, a clean offline sync, failover inside the tier commitment.
Day 30
The assessor reads the controls
Walk the assessor through the controls list, the written statement of what the platform can see, and the first hourly invoice.
Day 60
Decision
Move more stores, add Sealed where no human may read card data, or stop. Leaving costs the transfer rate and nothing else.
Questions
What buyers ask before they sign.
In the order they come up. Every answer ends with where to check it.
10 answers
All questionsWill our QSA accept a cardholder data environment drawn on this?
Your assessor scopes it; the controls make the drawing small. One private network per customer, databases on private endpoints by default, ingress published only for allowed domains, SSH by key only. The scope is your private cloud, not a provider's shared estate.
Proofthe controls list on the Security page and the PCI DSS v4.0.1 document library.[1]
Do you hold a PCI Attestation of Compliance we can cite in our report?
No. The attestation behind the platform is a SOC 2 Type II report with an unqualified opinion, under NDA. It is not a PCI Attestation of Compliance, and your own attestation remains yours to earn with your assessor.
Proofthe SOC 2 Type II report under NDA and the attestation list on the Security page.[2]
Who can see a card number while it is being processed?
Nobody outside your private cloud. The platform underneath sees that a workload exists, how big it is and what it costs. Where no human may read card data in use, Sealed keeps it unreadable inside an enclave, available for inference today and arranged with an engineer for other work.
Proofthe access table on the Security page and the honest limits on the Sealed page.
What does the authorisation path cost a month?
Machines from $0.024 an hour, hourly, no minimum term. Object storage $0.02 per GB a month. Managed databases are quoted per size in writing. Inbound traffic is free; outbound from $0.01 per GB. Payment processing is quoted separately, in writing, before you sign.
Proofthe published rate card, August 1, 2026, and a written quote for databases and processing.[3]
If we change acquirers or platforms, what does it cost to leave?
The outbound transfer rate and nothing else. No exit fee, no minimum term. PostgreSQL 17 dumps and S3 tools work on the last day as on the first, so the move is a copy, not a migration project.
Proofthe transfer bands in the published pricing and the no-exit-fee clause in the contract.[3]
Can the till keep taking cards when the store's line drops?
A Triple X Cloud Node in the store keeps working locally and syncs when the line returns. Records live on the device first. It is the same private cloud as the hosted nodes. Stand-in rules and reconciliation remain yours to define.
Proofthe Sovereign page and the offline test written into your pilot plan.
What happens if the database fails during a settlement run?
The managed database runs three nodes with automatic failover. Continuous archiving holds seven days of history; restore to any second into a new database while the source keeps running. Backups are kept in a separate region.
Proofthe managed databases overview in the documentation, August 1, 2026.[4]
Is data encrypted at rest, in the words an assessor will accept?
Storage at the edge is encrypted. The published documentation does not yet state server-side encryption for object storage, so ask for the written statement with your private cloud before your assessor asks, and file it with your scope.
Proofthe encryption answer on the Security page and the written statement for your private cloud.
What do we hand the assessor?
The SOC 2 Type II report under NDA. The annual penetration test letter under NDA. The subprocessor list in writing. A written statement of what the platform can and cannot see. Sealed receipts for any run where no human could read the data.
Proofthe Security page's evidence list and the SOC 2 report under NDA.[2]
How do we start, and what is not included?
Draw your scope with Triple X and bring your assessor to the first call. Not included: a PCI Attestation of Compliance, a tokenisation service, card-brand registration, or payment processing, which is quoted separately. The free tier is enough to build the drawing.
Proofthe Contact page and a written quote from Triple X for your private cloud.
No questions under this term yet. Ask Triple X.