Network Tokenization and PCI Scope

The vault and detokenize proxy are the only PAN-aware components

Network Tokenization and PCI Scope The vault and detokenize proxy are the only PAN-aware components PCI-DSS zone Out of scope Card Entry · hosted field · Architecture component Card Entry hosted field Tokenization Svc · mint token · PCI-DSS zone Tokenization Svc mint token Token Vault · PAN mapping · PCI-DSS zone Token Vault PAN mapping App Systems · token only · Out of scope App Systems token only Detokenize Proxy · acquiring edge · PCI-DSS zone Detokenize Proxy acquiring edge Processor · card rail · Architecture component Processor card rail Token Requestor · provision · PCI-DSS zone Token Requestor provision Scheme TSP · network tokens · Architecture component Scheme TSP network tokens PAN store token provision request auth req resolve authorize Legend External Backend Database Security Cloud

PCI zone

  • • Vault and proxy are the only PAN-aware parts
  • • App systems handle tokens only

Network tokens

  • • Scheme TSP issues a per-card token
  • • One-time cryptogram per auth blocks replay

Boundary rule

  • • Only two hops reach a real PAN
  • • Capture bypasses your own servers

Architecture diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • T theme • E export