Skip to main content

Payment Card Industry (PCI)

The Payment Card Industry Data Security Standard (PCI DSS)External LinkThis link leads to an external website and will open in a new tab applies to organizations that store, process, or transmit cardholder data or sensitive authentication data, and to systems and services that can affect the security of the cardholder data environment. Identify whether a Files.com workflow contains payment-card account data or supports that environment. Financial statements, invoices, and other financial records do not automatically become cardholder data simply because they concern a payment.

Outsourcing payment processing does not remove a merchant's PCI responsibilities. The PCI Security Standards Council explains the responsibilities that remainExternal LinkThis link leads to an external website and will open in a new tab, including overseeing relevant providers. Confirm the scope and validation requirements with the organization accepting your compliance, such as your acquiring bank or payment brand.

For Files.com, distinguish our handling of your subscription payment from any cardholder data your organization chooses to store or exchange through the platform. Review the AOC for the service you rely on and determine the controls your organization must operate.

Files.com PCI Compliance Status

Files.com is a Level 2 PCI DSS Certified Service Provider for its own billing and for storage of customer cardholder data. Customers storing PCI-regulated data must maintain their own overall PCI compliance and review the applicable Attestation of Compliance (AOC). The certification covers two scenarios.

The first is processing our own billing transactions. Files.com handles cardholder data for its own billing and account management functions, and all credit card transactions run through PCI-compliant third-party providers: Stripe, Braintree, and PayPal, all of whom are also PCI-certified.

The second is storing cardholder data on behalf of customers. Files.com is certified to store PCI-regulated cardholder data for customers subject to PCI DSS, provided those customers maintain their own overall PCI compliance.

Files.com is open to pursuing Level 1 PCI certification for the customer storage scenario when a customer engagement requires it. The audit scope would expand, but there is no material difference in the work we've already done to meet PCI standards.

Our most recent Attestation of Compliance (AOC) is available through the Trust CenterExternal LinkThis link leads to an external website and will open in a new tab. Document Requests explains access and NDA requirements. Your Account Executive or Account Manager can help with the request and questions about the scope.

About PCI DSS

PCI DSS is managed by the PCI Security Standards Council, a global body founded by major payment brands including Visa, MasterCard, American Express, Discover, JCB, and UnionPay.

The standard defines 12 requirements that protect cardholder data and maintain a secure environment. The requirements fall under goals that include securing networks, managing vulnerabilities, and enforcing access control. Organizations subject to PCI DSS must:

  • Install and maintain secure firewalls
  • Encrypt cardholder data
  • Use antivirus and anti-malware tools
  • Restrict access to cardholder data on a need-to-know basis
  • Monitor and test networks regularly
  • Maintain a company-wide security policy

Compliance is validated annually through assessments and security scans. The exact validation requirements depend on the organization's role in the payment ecosystem and its transaction volume.