Skip to main content

​
Security & Responsible Disclosure

⚠️ DRAFT DOCUMENT — PENDING FINAL CORPORATE COUNSEL REVIEW
Last Updated: October 26, 2026 • Version: 1.0-draft
Canonical Reference: https://lifecycle.pcnaid.com/apple-pay/legal/security

​
1. Security Architecture & PCI DSS Scope

Security is fundamental to the Pcnaid platform architecture. Pcnaid Lifecycle Manager is engineered to eliminate cardholder vulnerability vectors by isolating payment decryption to Stripe Connect:
  • Zero PAN Exposure: Unencrypted primary account numbers, CVVs, and magnetic stripe data never traverse, enter, or reside within Pcnaid databases or Workers.
  • PCI DSS Level 1 Containment: Token decryption occurs exclusively inside Stripe’s audited Level 1 PCI vault.
  • Mutual TLS (mTLS): All Apple Pay session validation requests connect to Apple’s servers through an isolated Azure mTLS proxy holding hardware-secured cryptographic certificates.
  • Edge Infrastructure: Edge workers run on Cloudflare Enterprise with Page Shield script integrity monitoring, advanced rate limiting, and automated SSL certificate rotation.

​
2. Responsible Disclosure Policy

Pcnaid welcomes reports from independent security researchers to help us maintain the security and integrity of our systems. If you believe you have discovered a vulnerability in a Pcnaid application, API, or edge worker, we encourage you to disclose it responsibly.

​
3. Guidelines for Researchers

When investigating potential security issues, please:
  • Avoid executing attacks that could degrade system performance, execute denial of service (DoS), or disrupt merchant checkouts;
  • Do not view, alter, exfiltrate, or destroy customer or merchant data;
  • Give us a reasonable period of time (typically 90 days) to remediate the vulnerability before public disclosure;
  • Interact only with test accounts that you own or have explicit written permission to test against.

​
4. Reporting a Vulnerability

Submit your report to our security engineering team at security@pcnaid.com. Please include in your submission:
  • A detailed description of the vulnerability, including affected endpoints and severity assessment;
  • Step-by-step reproduction instructions or a minimal proof of concept (PoC);
  • Any proposed mitigations or remediation steps.

​
5. Safe Harbor

If you conduct your research in good faith and in compliance with this Responsible Disclosure Policy, Pcnaid will not pursue legal action against you or request law enforcement investigation regarding your research.