Financial Technology
We test whether your platform, APIs, codebase and cloud accounts are safe from attackers, and give assessors the evidence. Fintech companies move money and ship software at the same speed. We build the platforms underneath them, from Kubernetes and key management to the testing that shows an assessor what you built.
Payments, lending and money-transfer companies are software companies that happen to hold other people's money. They release weekly, run on cloud and Kubernetes, and answer to banking partners, card networks and regulators who ask the same question in different words: how do you protect the data?
Our team has designed a card-data platform built on Kubernetes with hardware-backed key management, and it knows the pipeline side as well: signed builds, policy-as-code and evidence that the platform generates for itself. We work with your engineers, not around them.
What we see in your industry
- PCI DSS 4.0.1 expects card data to be protected wherever it is stored, processed or transmitted, with strong cryptography, logging and regular testing. The smaller your cardholder-data environment, the smaller the assessment.
- Banking partners and enterprise customers send due-diligence questionnaires that ask where keys live, who can reach production and how changes are reviewed.
- Cross-border operation brings data-location questions. Chapter V of the GDPR (Articles 44 to 50) permits transfers of personal data outside the EU and EEA only on a recognized basis, so architecture decisions are also legal decisions.
- Speed is the business. Controls that slow releases get bypassed, so they have to live in the pipeline: signed images, policy-as-code and automated evidence.
Scope is the first lever. Under PCI DSS 4.0.1, every system that stores, processes or transmits card data, and every system connected to one, is in scope. Putting card data in one cluster and replacing card numbers everywhere else with tokens turns an assessment of the whole company into an assessment of one platform.
Keys are the second. Encryption is only as strong as the place the key lives. Hardware security modules keep key-encryption keys inside tamper-resistant hardware, and Kubernetes KMS envelope encryption lets the cluster use them without ever holding them. We design the key hierarchy, the rotation schedule and the recovery procedure, and we test that recovery works.
Testing is the third. We attack the platform from the position of a compromised workload: lateral movement, service-account abuse, reading secrets, extracting keys. The report is written so that an assessor or a banking partner can reuse it as evidence. Our article on PCI DSS 4.0.1 explains the future-dated requirements that became mandatory on March 31, 2025.
Cross-border operation adds data-location rules on top. Chapter V of the GDPR (Articles 44 to 50) allows personal data to move to a country outside the EU and EEA only on a recognized basis, such as an adequacy decision or appropriate safeguards, so we design regional clusters and key hierarchies that keep data where it must stay, and we document the data flows your partners ask about.
Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a market-data platform and post-quantum wallets taken to mainnet in ten days, ALM and CECL models built in-house at a mid-size bank (illustrative), the Kubernetes card-data platform with hardware security modules (illustrative), a hedge fund's low-latency colocation, and a SaaS company's anycast edge.
Related work on our track record: a two-site colocation build with A/B power, a 400G spine and burned-in servers (illustrative).
PCI DSS 4.0.1 for Small Merchants: What Changed, What Is Now Required, and How to Cut Scope
PCI DSS v4.0.1 is the only active version of the card-security standard. The requirements that were best practices until March 31, 2025 are now mandatory in every assessment. For a small merchant the work depends on the Self-Assessment Questionnaire that applies. This article explains the version history, the changes that reach small businesses, what the SAQ types mean, and how to reduce what you must protect.
Work like yours
One company in fourteen countries, with separate networks by region and business unit and zero downtime
A multinational manufacturer and distributor operating in 14 countries, a leader in its segment.
14 countries, 4 regions, 6 business units, 9 datacenter and carrier-neutral facilities, 10G to 100G fabricsRead the case
A petabyte of storage for a 150 TB risk database, live in two data centers
A balance-sheet risk analytics firm that serves banks and financial institutions, with models for interest-rate risk, net interest income and valuation. A leader in its segment.
1 PB storage, 150+ TB database, 1 TB+ RAM and 128 cores per production server, New York + New Jersey, SOC 2Read the case
A 100G colocation built for microseconds: PTP time, kernel-bypass and no surprises
A systematic hedge fund in New York and New Jersey, a leader in its segment.
2 colocation sites, 100 Gb/s links, sub-100 ns clock accuracy, microsecond-class software pathRead the case
Anycast DNS and edge for a SaaS company, absorbing attacks close to where they start
A business-software company serving customers in North America and Europe, a leader in its segment.
9 points of presence, own ASN and address space, anycast DNS and HTTPS edge, DNSSECRead the case
A cross-border payments platform on Kubernetes, with card data sealed by hardware security modules
A cross-border payments company moving money between the United States, Europe and Latin America, a leader in its segment.
3 Kubernetes clusters in 2 regions, about 140 services, 2,400 transactions per second at peak, network-attached HSM clusterRead the case
Surviving the holiday peak: two CDNs, an origin shield, a WAF and bot management
An online retailer shipping to the United States and Canada, a leader in its segment.
~38,000 requests/s at peak, ~45 Gb/s edge egress, 2 CDNs, 1 origin shield tier, 3 regionsRead the caseHow we help
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreTailored Software
Software built around your business in weeks, and you own the code.
Learn moreDatacenter & Colocation Builds
Cages, racks, power, cabling and servers, built by the people who will run them.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow do you reduce PCI DSS scope for a payments platform?
The smaller the cardholder-data environment, the smaller the assessment. Our fintech case isolates card data in one dedicated Kubernetes cluster with a tokenization service as the only component that sees a full card number. Every other service holds only tokens.
How do you keep security controls from slowing releases?
Controls that slow releases get bypassed, so they live in the pipeline: signed images, policy-as-code and automated evidence. GitOps delivery with two-person review on production changes records who changed what. The platform then produces audit evidence instead of teams assembling it by hand.
Can you help with due-diligence questionnaires from banking partners?
Yes. These ask where keys live, who can reach production and how changes are reviewed. We document the architecture so the answers are accurate, and we run penetration tests that show an assessor what was built.
Does operating across borders change the architecture?
Yes. The GDPR restricts transfers of personal data out of the European Economic Area, so architecture decisions about where data lives are also legal decisions. We design regions and data flows with that in mind and recommend you confirm requirements with your counsel.
Who is responsible for PCI DSS when we use a payment processor?
Both of you. A processor or hosted payment page can shrink your scope, but it does not remove your duty to protect the pages and systems that touch the payment flow. Requirement 12.8 expects you to track which PCI DSS requirements each service provider covers and which remain yours. We build that responsibility matrix with your team and keep it current.
How do you limit who can reach production?
Engineers use named accounts with MFA, short-lived access granted for a ticket, and a bastion or access proxy that records sessions. Production secrets stay in a vault, not in code or chat. Standing administrator rights are removed, and every grant is logged and reviewed. Banking partners usually ask for exactly this evidence in due-diligence questionnaires.