PCI DSS & Card Data Handling

When using DigetPay Embedded Integration, you are responsible for understanding and meeting the PCI DSS requirements applicable to your payment implementation.

PCI DSS Scope

With Embedded Integration, card data is collected as part of your own payment experience before it is sent to DigetPay from your secure backend.

This can place your systems within PCI DSS scope.

The exact PCI DSS requirements that apply depend on your architecture, data flow, storage, access controls, and payment implementation. Your organization is responsible for determining the appropriate compliance requirements for its environment.

Card Data You Must Protect

Sensitive payment data can include:

Recommended Card Data Flow

Use the following flow when implementing Embedded Integration:

sequenceDiagram
    autonumber

    participant Customer
    participant App as Your Checkout
    participant Backend as Your Secure Backend
    participant DigetPay
    participant Gateway

    Customer->>App: Enter card details
    App->>Backend: Send payment data over HTTPS
    Backend->>Backend: Generate request hash
    Backend->>DigetPay: POST /payment/s2s/sale
    DigetPay->>Gateway: Process payment
    Gateway-->>DigetPay: Payment result
    DigetPay-->>Backend: Response
    Backend-->>App: Payment result

    Note over Backend: Do not persist PAN or CVV

Backend-Only Payment Processing

All of the following operations must be handled by your secure backend:

• Storing the DigetPay x-api-key
• Generating the request hash
• Calling Embedded Integration APIs
• Processing direct sale requests
• Handling transaction status
• Processing capture and void requests
• Processing recurring payment requests

Your API key must never be exposed in:

• Browser JavaScript
• Mobile application source code
• Public repositories
• Client-side configuration files
• Screenshots or support tickets
• Public documentation

Secure Your Payment Endpoint

Your payment endpoint should:

• Use HTTPS.
• Authenticate and authorize requests where applicable.
• Restrict access to approved application components.
• Validate incoming request data.
• Protect against unauthorized access.
• Prevent sensitive payment data from being written to logs.
• Return only the information required by the client.
• Avoid storing raw payment request or response bodies.

Do Not Log Card Data

Application logs, debugging tools, monitoring systems, analytics platforms, and error-tracking services must not capture sensitive card data.

Do not log:

Full card number
CVV / CVC
Complete payment request bodies containing card data
Raw request headers containing credentials
Full API keys
Full authentication tokens

When troubleshooting, mask sensitive values.

Example

Do not log:

{
  "cardNumber": "4111111111111111",
  "cvv": "123"
}

Use masking instead:

{
  "cardNumber": "411111******1111"
}

Secure Credential Handling

Your DigetPay credentials are sensitive and must be protected.

Merchant API Key

Used to authenticate payment API requests:

x-api-key: YOUR_MERCHANT_API_KEY

Request Hash

The Direct Sale API requires a request hash generated by your backend.

Do not expose your API key or hash generation logic to:

• Browser code
• Mobile applications
• Frontend configuration
• Public source repositories

Store credentials using environment variables or a secure secrets-management solution.

Token-Based Future Payments

Use DigetPay payment or recurring tokens for supported future payment scenarios instead of retaining raw card data.

For recurring payments:

1. The customer completes the initial payment.
2. DigetPay generates a recurring token.
3. Store the token securely on your backend.
4. Use the token for supported future recurring charges.

See Recurring Payments for the recurring payment flow.

3-D Secure

Some payments require 3-D Secure authentication.

When DigetPay returns htmlContent:

1. Return the required authentication content to the customer payment flow.
2. Render the authentication flow exactly as required.
3. Wait for the authentication flow to complete.
4. Verify the final transaction status using the Status API or webhook.
5. Do not treat the initial Direct Sale response alone as the final payment result when additional authentication is required.

Security Checklist

Before going live with Embedded Integration, verify that:

• Your PCI DSS obligations have been reviewed.
• Card data is transmitted only over HTTPS.
• The DigetPay API key is stored server-side.
• Request hashes are generated only on your backend.
• PAN and CVV are not written to logs.
• CVV is never stored after authorization.
• Raw card data is not stored unless explicitly permitted by your PCI DSS controls and payment architecture.
• Access to payment systems is restricted.
• Production credentials are stored securely.
• Recurring tokens are stored securely.
• Sensitive credentials are masked in logs.
• Payment results are verified before orders are fulfilled.
• The implementation has been tested in Fin Staging before production deployment.

Hosted Checkout vs Embedded Integration

Related Documentation