The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements established by the PCI Security Standards Council to protect cardholder data. Any entity that stores, processes, or transmits cardholder data must comply with PCI DSS.
ClearRoute operates as a payment routing middleware, not a payment processor or card issuer. We do not store, process, or transmit full card numbers, CVV, or cardholder names. Transaction data flowing through ClearRoute passes through to your configured PSPs, who handle the actual card data under their own PCI DSS compliance programs.
Because ClearRoute does not store cardholder data (CHD), our compliance obligations are scoped to the SAQ-A (Self-Assessment Questionnaire A) requirements. This is the least burdensome PCI DSS questionnaire, appropriate for merchants who outsource all payment processing to a PCI-compliant third party.
The following table maps PCI DSS v4.0 requirements to ClearRoute's implementation:
| Req # | Requirement | Owner | ClearRoute Implementation |
|---|---|---|---|
| 1 | Install and maintain network security controls | Shared | Render.com manages network-level firewalling. All services deployed behind Render's isolated network boundaries. |
| 2 | Apply secure configurations to all system components | ClearRoute | All default passwords replaced, unnecessary services disabled. Neon PostgreSQL enforces TLS 1.2+ for all connections. |
| 3 | Protect stored account data | ClearRoute | ClearRoute does not store PAN, CVV, or cardholder names. PSP API keys are encrypted at rest (AES-256). No card data stored in our database. |
| 4 | Protect cardholder data in transit | ClearRoute | All data in transit encrypted via TLS 1.2+. HTTPS enforced for all API endpoints and the dashboard. |
| 5 | Protect all systems and networks from malicious software | ClearRoute | Render infrastructure provides automatic OS-level patching. Anti-virus/malware scanning implemented at host level by Render. |
| 6 | Develop and maintain secure systems and software | ClearRoute | Secure software development lifecycle. Dependencies kept up to date. No custom software processes cardholder data. |
| 7 | Restrict access to system components and cardholder data | ClearRoute | Role-based access control enforced at the application layer. All database queries are customer_id scoped — cross-account access is structurally impossible. |
| 8 | Identify users and authenticate access | ClearRoute | Unique user accounts, bcrypt-hashed passwords (cost factor 12), JWT-based session management with 7-day expiry. |
| 9 | Restrict physical access to cardholder data | Shared | Render and Neon manage physical datacenter security. ClearRoute does not have physical access to hardware. |
| 10 | Log and monitor all access to system components and cardholder data | ClearRoute | All API requests logged with timestamp, customer_id, and action. Routing decision logs stored with PSP scores and outcomes. |
| 11 | Test security of systems and networks regularly | ClearRoute | Vulnerability scanning runs quarterly. Render infrastructure handles network-level penetration testing. |
| 12 | Support information security with organizational policies and programs | ClearRoute | ClearRoute maintains an internal information security policy reviewed annually. Security contact: security@clearroute.app. |
Using ClearRoute does not exempt you from your own PCI DSS obligations as a merchant. Your obligations depend on how you integrate ClearRoute:
Your cardholder data never touches your servers. You likely qualify for SAQ-A. Ensure your redirect/iframe implementation does not capture card data on your side.
Your servers handle card data. You likely need SAQ-D or a full Report on Compliance (ROC). Consult your acquiring bank.
ClearRoute receives transaction metadata (amount, transaction ID, PSP response) but does not receive or store full PAN or CVV. Your PSP is responsible for all card data handling. Confirm with your PSP that your integration is within their PCI DSS scope.
If you become aware of a suspected or confirmed compromise of cardholder data in connection with ClearRoute:
ClearRoute will make this compliance statement and relevant documentation available to customers upon request. We conduct an annual review of our PCI DSS posture.
Questions about ClearRoute's PCI DSS compliance should be directed to: security@clearroute.app.