PCI compliant eCommerce Hosting

PCI-DSS compliant hosting with IDNT

The Payment Card Industry Data Security Standard (or PCI-DSS) describes measures to protect not only the data of your customers, but also your data and thus your business. This is not only about credit card information, the standard describes important features that apply to secure hosting of online shops in general.

PCI-DSS checks your online shop and the systems connected to it. This test includes a description of the security measures taken as well as an online test for known vulnerabilities. These tests are carried out at regular intervals. This ensures that your systems meet the latest security requirements.

We support you with numerous measures and our experts will support you before and during the tests, as well as during the implementation of the requirements. If desired, we can also take care of the regular implementation ourselves. The following overview shows you the requirements and how we support you in this:

PCI-DSS Requirement	Our services
Implementation of a Firewall	All systems hosted at IDNT are protected by firewalls managed by our security experts and set up at several levels. You can collaborate with our experts to design the rules and determine how your application should be protected and filtered for unwanted traffic.
Secure storage of customer data	Information about the owner of a credit card must be specially protected. To ensure this, the software you use must provide appropriate security mechanisms. We are happy to support you with evaluation and implementation.
No standard passwords	All manufacturer-specific default passwords must be changed to a secure password. Access data for sensitive areas may generally only be accessible to persons who must have mandatory access to them.
Secure transmission over insecure networks	The transmission of sensitive data such as personal and credit card data must always be encrypted. The procedure must comply with current safety requirements. IDNT supports you with our SSL Offloading, for example, which negotiates the best possible encryption with the visitor's browser and prevents the use of dangerous algorithms. Furthermore, we support you in the selection of suitable SSL certificates and take over the regular renewal and installation on request.
Development and continuous maintenance for safe systems	As part of our Content Delivery Network, we offer you a special application firewall designed for web access, which checks every connection to your systems. By means of freely definable rules, this can be adapted to your application. Our team takes over the maintenance and optimization of this system, which eliminates most of the work in advance. We also support you and your software developers with code reviews and best practice information.
Restrict access to sensitive information	Sensitive information such as personal and credit card information may only be accessible to persons who absolutely need access to it. The accesses must always be assigned to an individual person so that accesses can be traced. IDNT Identity Services gives you the ability to automatically access all your information in detail and control it.
Unique user IDs	Each access authorizations must be uniquely identifiable so that accesses can be traced and assigned to a person. IDNT Identity Services automatically does this because all accesses to information stored at IDNT are authorized on a personal basis.
Two-Factor Authentication	Passwords have always been a problem in many ways as the sole authentication feature. Two Factor Authentication is automatically activated for accessing your systems via IDNT Identity Services and the IDNT Console Gateway. In addition to the user, password and key file, a one-time code is sent to the user's mobile phone for access. Only the valid combination of these factors allows access to the systems. For example, a lost password can no longer be a security problem.
Restricted physical access	IDNT data centers meet the highest security standards and are regularly checked for security. Physical access is only possible for a few employees and is monitored up to every single system by numerous measures such as video surveillance and access control. Since we work exclusively with our own infrastructure and do not offer co-location services, access for other people or visitors is not possible.
Regular tests of the safety precautionsn	Our specialists constantly monitor all security precautions taken by us and develop solutions that are constantly adapted to the latest threats. Regular certifications and safety checks guarantee the highest safety standards on a permanent basis.
Commitment to comply with data protection and security regulations for all employees	If you have not already done so, you must take appropriate measures in-house. IDNT supports you, for example, by providing you with an agreement for order data processing.