papers/hanzo-checkout/sections/05-pci-compliance-architecture.tex

\section{PCI Compliance Architecture}


\subsection{Compliance Requirements}

PCI DSS Level 1 mandates strict controls for systems handling payment card data. Our architecture achieves compliance through:

\begin{enumerate}
    \item \textbf{Tokenization}: Raw card numbers never reach merchant systems
    \item \textbf{Encryption}: All sensitive data encrypted at rest and in transit
    \item \textbf{Isolation}: Payment processing in dedicated, audited infrastructure
    \item \textbf{Logging}: Comprehensive audit trails with tamper detection
\end{enumerate}

\subsection{Data Flow Model}

\begin{definition}[PCI Scope Boundary]
The PCI scope boundary $\mathcal{B}$ partitions the system into:
\begin{itemize}
    \item $\mathcal{B}_{in}$: Components handling raw card data (Hanzo Vault)
    \item $\mathcal{B}_{out}$: Components handling only tokens (Merchant systems)
\end{itemize}
\end{definition}

\begin{theorem}[Scope Reduction]
Merchant systems $M \in \mathcal{B}_{out}$ have reduced PCI scope:
\[
\forall d \in data(M) : d \notin PAN \cup CVV \cup PIN
\]
\end{theorem}

\subsection{Vault Architecture}

The Hanzo Vault provides secure credential storage:

\begin{lstlisting}[language=Python, caption=Vault Interface]
class HanzoVault:
    def tokenize(self, card_data: CardData) -> Token:
        """Store card, return token. Card data never leaves vault."""
        encrypted = self.encrypt(card_data, key=self.master_key)
        token_id = self.generate_token_id()
        self.store(token_id, encrypted)
        return Token(id=token_id, last4=card_data.number[-4:])

    def authorize(self, token: Token, amount: Decimal) -> AuthResult:
        """Authorize payment using token. Decryption internal."""
        card_data = self.decrypt(self.retrieve(token.id))
        return self.gateway.authorize(card_data, amount)
\end{lstlisting}