When a QSA defines your PCI scope, it's always larger than when you define it. Document exactly where cardholder data flows, where it's encrypted, and where your boundary sits — and hand the QSA your scoping document before they start drawing their own.
The specific outcomes this tool produces — and the problems it prevents.
A written data flow brief that answers every QSA scoping question before it's asked. Ambiguous scope is always resolved in the QSA's favour — and that means a larger CDE, more controls, and a longer assessment.
Every system that's explicitly out of scope and documented as such is a system the QSA doesn't assess. Every boundary left ambiguous is a system they might include. Document the boundary yourself.
Show exactly where data is encrypted, tokenised, or descoped at each stage. A tokenisation point that's annotated in the data flow brief is a descoping argument. One that isn't annotated is invisible to the QSA.
A formatted data flow brief submitted as part of your pre-assessment pack reduces on-site scoping time significantly and demonstrates that your team understands your own PCI boundary.
Structured inputs. Immediate output. No setup, no waiting, no consultant required.
Define your payment entry points
Document how cards enter your system — hosted fields, direct API, terminal, or third-party processor. Each entry point is a scoping decision.
Map each data flow stage
Walk through authorisation, processing, settlement, and storage. At each stage, document what cardholder data is present and in what form.
Mark encryption and tokenisation points
Annotate exactly where sensitive data is protected, tokenised, or reduced in scope. These annotations are your descoping evidence.
Define the CDE boundary
Set the PCI scope boundary around components that touch cardholder data. Explicitly exclude out-of-scope components with justification.
Export your scoping document
Download a formatted written brief to submit to your QSA, include in your acquirer due-diligence pack, or store in your compliance evidence folder.
Join Sync Your Cloud and generate your cardholder data flow document in minutes.