LegalPCI DSS
PCI DSS status and responsibilities
MAXFI is being assessed against PCI DSS 4.0.1 as a service provider. The assessment is in progress: the Report on Compliance (ROC) and the Attestation of Compliance (AOC) have not been issued yet. This page shows the current state and how responsibilities are divided between MAXFI and the merchant.
Current status
- PCI DSS 4.0.1 assessment as a service provider — in progress; no AOC or ROC has been issued yet.
- Quarterly external vulnerability scan by an approved scanning vendor (ASV) — passed on 11 November 2026.
- External and internal penetration test by an independent company — completed in October 2026.
Responsibilities
| Control | MAXFI | Merchant | Notes |
|---|---|---|---|
| Card data entry | MAXFI | — | Card details are entered on the MAXFI payment page, served from maxfi-api.exezine.az — directly or in a frame opened by the Widget. They never pass through your servers. |
| Card data storage | MAXFI | — | The full card number is kept encrypted for at most 30 minutes to complete 3-D Secure; the CVC is never stored. After that only the first 6 and last 4 digits are kept. |
| Transmission to the acquiring bank | MAXFI | — | Over TLS. |
| Network segmentation | MAXFI | — | Systems that handle cardholder data run in a separate network segment; connections to it are denied unless explicitly allowed. |
| Vulnerability scans | MAXFI | — | External addresses are scanned every quarter by an approved scanning vendor (ASV). |
| Penetration testing | MAXFI | — | External and internal tests by an independent company; the latest was completed in October 2026. |
| PCI DSS assessment | MAXFI | — | The assessment against PCI DSS 4.0.1 as a service provider is in progress. |
| Your PCI DSS validation | — | Merchant | Card details do not reach your servers, which keeps your PCI DSS scope small. Which self-assessment questionnaire (SAQ) applies depends on how you integrate; send questions to compliance@pay2net.co. |
| Secret keys | — | Merchant | Keep secret keys (sk_…) on your server only; in web pages use only your publishable key (pk_…). Replace a key in the merchant portal if it may have been exposed. |
| Webhook verification | — | Merchant | Verify the X-MAXFI-Signature header (HMAC-SHA256) on every webhook; see Webhooks. |
How card data flows
- Your server creates a payment session. The customer opens the MAXFI payment page (checkout_url), or the Widget opens it in a frame on your site.
- The customer enters card details on the MAXFI payment page. Your servers never receive them.
- MAXFI sends the card details to the acquiring bank over TLS.
- To complete 3-D Secure, the full card number is kept encrypted for at most 30 minutes and is not stored after that. The CVC is never stored.
- MAXFI keeps the first 6 and last 4 digits of the card number. Your server receives card_last4, card_brand and the payment_id.
Logs
API request logs are kept for 395 days in both test and live mode; the audit trail is kept for 5 years. Card numbers are masked before they are written to logs, and the CVC never reaches the logs.