{"head":{"title":"PCI DSS for Software Teams: Scope and Controls | OceanLab","description":"What PCI DSS v4.0.1 means for software: who is in scope, the 12 requirements, ways to shrink the cardholder data environment and key dates.","canonical":"https://oceanlab.in/compliance/pci-dss"},"slug":"pci-dss","stats":{"builds":32,"industries":24,"countries":26},"featured":[{"meta":{"slug":"cenote","industry":"payments","projectType":"Payment gateway dashboard","country":"mx","tags":["fintech","saas"],"compliances":["PCI DSS","EMV 3-D Secure 2","Banxico card network rules","CFDI 4.0 (SAT)","LFPDPPP (2025)"],"cover":{"src":"/case-studies/cenote/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Cenote - Merchant Dashboard for a Mexican Payment Gateway","description":"Designed and built a clickable merchant dashboard for a Mexican online payment gateway that takes cards with meses sin intereses, SPEI transfers and OXXO cash vouchers in MXN: every payment from authorisation to settlement, declines in plain language, refunds with approval limits, chargebacks sorted by deadline and payouts that break down to the last fee.","category":"Payments / Payment Gateway Dashboard","client":"Mezquite Pagos"}}},{"meta":{"slug":"contrepoint","industry":"payments","projectType":"Reconciliation engine","country":"fr","tags":["fintech","enterprise"],"compliances":["EBICS and ISO 20022 (camt.053)","CFONB 120","SEPA SCT and SDD","Plan Comptable Général","FEC (LPF L47 A)","Code de commerce L123-22","GDPR","PCI DSS (out of scope)"],"cover":{"src":"/case-studies/contrepoint/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Contrepoint - Three-Way Reconciliation Engine for Orders, PSP Payouts and Bank Lines","description":"Designed and built a clickable reconciliation engine for a Lyon-based marketplace group paid through Adyen, Stripe, PayPal and SEPA: it matches orders to PSP transactions, payouts and bank statement lines, explains every suggestion, turns what is left into a worked exceptions queue and traces each match to the journal entries it posts.","category":"Payments / Reconciliation Engine","client":"Verdane Marché"}}},{"meta":{"slug":"parley","industry":"payments","projectType":"Chargeback manager","country":"us","tags":["fintech","enterprise"],"compliances":["PCI DSS","CCPA","Visa Claims Resolution","Visa CE3.0","Visa VAMP","Mastercard ECP"],"cover":{"src":"/case-studies/parley/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Parley - Chargeback Manager with One Dispute Desk Across Every PSP","description":"Designed and built a clickable chargeback manager for a US merchant group with four online brands on Stripe, Adyen and Braintree: one inbox for every dispute with deadline countdowns, evidence gathered per reason code, a fight or accept recommendation with its reasons, pre-dispute alerts and dispute ratios tracked against network thresholds.","category":"Payments / Chargeback Management","client":"Fernhollow Commerce Group"}}},{"meta":{"slug":"rastro","industry":"payments","projectType":"Corporate cards & spend","country":"es","tags":["fintech","saas","tax"],"compliances":["PSD2 and SCA (RDL 19/2018)","PCI DSS","Invoicing rules (RD 1619/2012)","SII","Veri*factu (RD 1007/2023)","Ley Crea y Crece (Ley 18/2022)","IRPF allowance limits","Código de Comercio","AML (Ley 10/2010)","GDPR","LOPDGDD"],"cover":{"src":"/case-studies/rastro/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Rastro - Corporate Cards and Spend Management with IVA-Ready Receipts","description":"Designed and built a clickable spend-management platform for a Valencia fintech that gives Spanish SMEs company cards: budgets and card controls checked at authorisation, every transaction matched to its receipt, IVA marked recoverable or not from the invoice type, and a keyboard-driven review queue that turns card spend into bookable entries.","category":"Payments / Corporate Cards & Spend","client":"Almadraba Pagos"}}},{"meta":{"slug":"bloomwright","industry":"ecom","projectType":"Subscription box","country":"us","tags":["enterprise"],"compliances":["ROSCA","FTC Act Section 5","California Automatic Renewal Law","Minnesota Automatic Renewal Law","FTC Mail Order Rule","PCI DSS","CCPA/CPRA","CAN-SPAM","TCPA"],"cover":{"src":"/case-studies/bloomwright/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Bloomwright - Coffee Subscription Platform with Honest Cancellation","description":"Designed and built a clickable subscription platform for a specialty coffee roaster shipping across the contiguous US: a care workspace to skip, swap, pause, refund and cancel for subscribers, a cancel log that replays every screen a subscriber saw, and fulfilment batches that hold boxes with an unverified address, a failed payment or short stock.","category":"E-commerce & D2C / Subscription Box","client":"Loonshadow Coffee Roasters"}}},{"meta":{"slug":"almendro","industry":"travel","projectType":"Hotel booking engine","country":"cr","tags":["saas","enterprise"],"compliances":["Law 8968 (Costa Rica)","Law 7472 (Costa Rica)","GDPR and UK GDPR","PCI DSS","PSD2 SCA and EMV 3-D Secure"],"cover":{"src":"/case-studies/almendro/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Almendro - Direct Booking Engine and Rates Console for a Costa Rican Hotel Group","description":"Designed and built a clickable hotel console for a Costa Rican group of seven boutique hotels and eco-lodges: a dashboard of direct business, every booking with its price, payments and policy snapshot, a rates and availability grid where derived plans follow the best available rate, and a refund queue with approval limits.","category":"Travel & Hospitality / Hotel Booking Engine","client":"Sotobosque Hoteles"}}}],"all":[{"slug":"almendro","title":"Almendro - Hotel booking engine"},{"slug":"bloomwright","title":"Bloomwright - Subscription box"},{"slug":"calada","title":"Calçada - B2B wholesale portal"},{"slug":"cayuco","title":"Cayuco - Voice AI call centre"},{"slug":"cenote","title":"Cenote - Payment gateway dashboard"},{"slug":"contrepoint","title":"Contrepoint - Reconciliation engine"},{"slug":"driveluxe","title":"DriveLuxe - EV ride-hailing app"},{"slug":"dufaa","title":"Dufaa - Alumni network"},{"slug":"garita","title":"Garita - Log search (SIEM-lite)"},{"slug":"ichu","title":"Ichu - Customer self-care app"},{"slug":"kalafat","title":"Kalafat - Short-term rental manager"},{"slug":"kaudi","title":"Kaudi - Family money app"},{"slug":"kranich","title":"Kranich - Donation checkout"},{"slug":"lakour","title":"Lakour - Table reservations"},{"slug":"parley","title":"Parley - Chargeback manager"},{"slug":"pasje","title":"Pasje - Card issuing & controls"},{"slug":"pawsatrest","title":"Paws at Rest - Pet cremation tracker"},{"slug":"pitline","title":"Pitline - Voice agent"},{"slug":"quartet","title":"Quartet - BNPL checkout"},{"slug":"rastro","title":"Rastro - Corporate cards & spend"},{"slug":"returnable","title":"Returnable - Reusable packaging"},{"slug":"ruinsguide","title":"Ruins Guide - Heritage visitor app"},{"slug":"setback","title":"Setback - Permits & licences"},{"slug":"setwise","title":"Setwise - Personal trainer app"},{"slug":"soroban","title":"Soroban - Spend analytics"},{"slug":"stoiar","title":"Stožiar - EV charging app"},{"slug":"tambora","title":"Tambora - Ticketing platform"},{"slug":"taquara","title":"Taquara - Point of sale"},{"slug":"tartera","title":"Tartera - Headless storefront"},{"slug":"thila","title":"Thila - Guest experience app"},{"slug":"towpath","title":"Towpath - Course platform (LMS)"},{"slug":"zarpe","title":"Zarpe - Employee onboarding"}],"byIndustry":[{"id":"payments","label":"Payments","href":"/case-studies/industry/payments","count":4},{"id":"ecom","label":"E-commerce & D2C","href":"/case-studies/industry/ecom","count":3},{"id":"travel","label":"Travel & hospitality","href":"/case-studies/industry/travel","count":3},{"id":"banking","label":"Banking & lending","href":"/case-studies/industry/banking","count":2},{"id":"ai","label":"AI agents & automation","href":"/case-studies/industry/ai","count":1},{"id":"energy","label":"Energy & utilities","href":"/case-studies/industry/energy","count":1},{"id":"events","label":"Events & ticketing","href":"/case-studies/industry/events","count":1},{"id":"fitness","label":"Fitness & wearables","href":"/case-studies/industry/fitness","count":1},{"id":"food","label":"Food & restaurants","href":"/case-studies/industry/food","count":1},{"id":"govtech","label":"GovTech","href":"/case-studies/industry/govtech","count":1},{"id":"heritage","label":"Museums & heritage","href":"/case-studies/industry/heritage","count":1},{"id":"higher","label":"Higher ed & corporate learning","href":"/case-studies/industry/higher","count":1}]}