payment-pci-security

Enforces PCI-compliant card data handling and Secure Proxy routing for VTEX payment connectors.

39|9|Updated Mar 16, 2026

Search Tags:#data-protection #pci-dss #secure-proxy #card-tokenization #payments-security #logging-redaction

Ready to run

npx skills add https://github.com/vtexdocs/ai-skills --skill payment-pci-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: payment-pci-security
Source: https://github.com/vtexdocs/ai-skills/tree/main/tracks/payment/skills/payment-pci-security
Command: npx skills add https://github.com/vtexdocs/ai-skills --skill payment-pci-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Handling card data for payments requires strict PCI DSS adherence and correct routing through Secure Proxy to prevent data exposure. This Skill provides guidance for designing and validating data flows, tokenization practices, and logging safeguards to ensure compliant integrations.

Core Features & Use Cases

Enforces Secure Proxy decision logic across PCI and non-PCI environments.
Defines token-based vs raw data handling, safe storage rules, and redacted logging patterns.
Use Case: Build a VTEX payment connector that routes card data through Secure Proxy and audits data handling for PCI compliance.

Quick Start

Use this Skill to enforce Secure Proxy flows for a new payment provider integration.

Frequently Asked Questions about payment-pci-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I route card data through a Secure Proxy for PCI DSS compliance?▼

To route card data through a Secure Proxy for PCI DSS compliance, you must route sensitive payment information through the proxy when required, ensuring strict adherence to tokenization and data flow rules. This prevents raw data exposure across VTEX payment connectors.

When do I need Secure Proxy for payment connector integrations?▼

You need Secure Proxy for payment connector integrations when handling card data in non-PCI-certified environments. It enforces PCI-compliant decision logic by routing sensitive information safely and applying token-based data handling.

What is token-based card data handling in VTEX IO apps?▼

Token-based card data handling in VTEX IO apps replaces raw sensitive card details with secure tokens. This process ensures strict PCI DSS adherence by preventing direct exposure and enforcing safe storage constraints for non-sensitive fields.

How do I redact sensitive payment information in logs?▼

To redact sensitive payment information in logs, apply redacted logging patterns that strip raw card data before storage. This ensures PCI-compliant data handling and prevents accidental exposure of sensitive payment details during auditing.

Does Secure Proxy work with both PCI-certified and non-PCI environments?▼

Yes, Secure Proxy works with both PCI-certified and non-PCI environments. It enforces decision logic across both setups, defining whether raw data or token-based handling is required to maintain strict PCI DSS compliance.

What are the storage constraints for non-sensitive payment fields?▼

Storage constraints for non-sensitive payment fields require strict limitations on what data can be retained after processing. By applying PCI-safe rules, the system ensures only approved non-sensitive information is stored while sensitive card data is tokenized or routed through Secure Proxy.