The platform is built around the QSA evidence pack problem. The most time-consuming — and most costly — part of any PCI DSS assessment is producing the documentation your assessor will ask for. Our tools generate exactly that:
- PCI DSS Gap Analysis: Requirement-by-requirement walkthrough against v4.0 with risk severity ratings, remediation priorities, and exportable structured output your team can act on immediately.
- Security Controls Matrix: A complete PCI DSS v4.0 controls catalogue mapped to your payment environment — implementation status per control, evidence pointers, and compensating control documentation. Exportable to Excel or your document management system.
- Cardholder Data Flow Diagrams: End-to-end payment data flows with scope boundary demarcation — the first artefact most assessors request.
- Compliance Decision Records: Structured records of key security decisions with full rationale and regulatory traceability — reviewed and signed off by your Solutions Architect on Shape and Architecture Assurance tiers.
On the Shape tier, your dedicated payments specialist reviews and contextualises all outputs against your specific environment before anything goes to your QSA.
Yes. All gap analysis, controls mapping, and scoring is built against PCI DSS v4.0 (including v4.0.1). The platform specifically covers the requirements that became mandatory in March 2025, including script management for payment pages, change and tamper detection mechanisms, targeted risk analysis requirements, and enhanced authentication controls.
If your last assessment was completed against v3.2.1 and you haven't yet mapped to v4.0, the gap analysis will identify every new or modified requirement that applies to your environment and prioritise the ones that carry the highest remediation risk.
Yes — and this is one of the least-documented areas in current PCI guidance. If an automated process touches, authorises, routes, or triggers transactions that involve cardholder data, it is almost certainly within your compliance scope. Your assessor will ask:
- Does each automated process operate under a unique, non-shared identity? (Requirement 8)
- Is access to cardholder data strictly limited and auditable? (Requirements 7 & 10)
- Are automated actions logged in a tamper-evident format? (Requirement 10)
- Does the process sit inside or outside your cardholder data environment boundary? (Scoping)
Our platform includes tools to design compliant identities for each automated process, simulate where each workflow sits relative to your compliance boundary, and generate the monitoring and audit trail configuration your assessor will look for.
We operate on a transparent base fee plus metered usage for users and connected payment environments.
- Scope Tier: £999/mo (base) + £49/user/month + £249/account/month. Full access to all 26 tools in simulation mode — run gap analyses, model your compliance posture, simulate policy scenarios, and view results on screen. No exports or AI recommendations. The right starting point if your compliance or risk team needs to evaluate the platform before committing to a full engagement.
- Sync Tier: £5,000/mo (base) + £49/user/month + £249/account/month. Full self-serve access with AI recommendations, report exports, and downloadable compliance artefacts — including structured evidence packs, security policy documentation, and compliance matrices ready for assessor or acquiring bank submission.
- Shape Tier: £10,000/mo (base) + £49/user/month + £249/account/month. Everything in Sync, plus a dedicated payments specialist embedded in your team. Monthly reviews, expert-validated compliance gap analysis, and compliance decision records prepared for assessor submission.
- Architecture Assurance: Custom engagement pricing. For businesses undergoing major payment infrastructure transformation, preparing for a formal audit, or requiring board-level compliance confidence. Contact us to scope.
The Payment Infrastructure Assessment is 100% free. You receive a scored PCI readiness report and your top 5 priority action items — focused on your AWS payment stack, PCI-DSS v4.0 posture, and agent architecture — within 24 hours.
This differs from our Scope, Sync, and Shape tiers, which unlock the full suite: ongoing compliance advisory, live access to all 26 architecture and compliance tools, unlimited assessments, historical compliance tracking, and (on Sync & above) full exportable QSA evidence artefacts.
Yes. There are no long-term lock-in contracts for Scope, Sync, or Shape tiers. Scope requires a 1-month minimum; Sync and Shape require a 3-month minimum. You can cancel at any time after the minimum term with 30 days written notice. Architecture Assurance engagements are scoped as fixed-term deliverables with terms agreed at the point of engagement.
No. We use a secure, agentless approach via read-only access roles and APIs. This ensures zero performance impact on your payment environment and requires no maintenance or software deployment on your systems. The access model itself follows least-privilege principles — aligned to PCI DSS Requirement 7.
We connect using read-only access with least-privilege permissions. We do not have write access to your environment — we cannot make changes to your systems. All data is encrypted in transit (TLS 1.2+) and at rest. The connection model is consistent with PCI DSS third-party service provider requirements under Requirement 12.8.
For Scope, Sync, and Shape tiers, the platform processes and analyses your payment environment data every 24 hours. Your compliance posture, risk findings, and status dashboards always reflect the current state of your payment infrastructure — not a point-in-time snapshot from last quarter.
A typical external QSA assessment costs between £30,000 and £150,000 depending on scope. The majority of that cost is driven by the evidence collection and RFI response cycle — which our platform eliminates. Clients on Shape and Architecture Assurance tiers typically arrive at their assessment with evidence packs already structured, scope boundaries already documented, and priority gaps already remediated. This reduces assessment duration, RFI volume, and re-assessment risk materially.
Beyond direct assessment cost reduction, businesses recover significant internal time previously spent on manual compliance preparation, documentation gathering, and security reviews — time that goes back into building and operating the payment business.
Yes. You can connect your full payment environment across development, staging, and production. The platform provides a unified view of PCI compliance status, risk posture, and scope boundary health across your entire payment infrastructure — not just a single environment. This is particularly important for businesses with separate environments per payment service or jurisdiction.
Still have questions?
Contact our team directly at enquiries@syncyourcloud.io