Security-first compliance
for PCI DSS v4.0.1
Strac Comply tracks 250 controls across the 12 PCI DSS v4.0.1 requirements. Pick your SAQ and connect your cloud and identity tools. Daily tests then collect the evidence for you.
14-day free trial. No credit card.
Read our PCI DSS guide- Controls
- 250
- Controls
- Automated tests
- 100+
- Automated tests, run daily
- Evidence base
- 1
- Evidence base for every framework
What is PCI DSS?
PCI DSS v4.0.1
Payment Card Industry Data Security Standard
Payment card security
PCI DSS is the security standard for any business that stores, processes or sends payment card data. Version 4.0.1 is current. The future-dated requirements from v4.0 became mandatory on March 31, 2025.
Strac Comply tracks 250 controls for the SAQ D and service provider profile, and scopes them down for smaller SAQs. Your level (1 to 4) depends on yearly card volume. Level 1 needs a yearly audit by a QSA.
Why Strac Comply for PCI DSS
PCI DSS tools target retail. We built Strac Comply for SaaS companies that take payments. Your real risk is in your cloud account, your identity provider and your code.
Daily tests check those systems against PCI DSS v4.0.1. Your QSA reviews the results in their own portal.
How Strac Comply runs PCI DSS
Strac Comply collects evidence every day, not the week before your audit.
Daily tests for MFA and passwords (Req 8), TLS and HTTPS (Req 4), and audit logging (Req 10). Key management tests cover Req 3
Pick your SAQ type, from SAQ A to SAQ D, and the requirements outside it drop out of your score
Vulnerability scanning of the web apps on your own domains, between pen tests. It is an automated scan. It does not replace a pen test (Requirement 11.4), internal scans (11.3.1) or ASV scans (11.3.2), where your SAQ or ROC includes them
Strac Comply keeps each Targeted Risk Analysis and compensating control worksheet next to the requirement it supports, ready for your QSA
An auditor portal your QSA opens by magic link. Strac Comply pins every item to the exact version they reviewed
250 controls. One evidence base.
A sample of the evidence behind the controls auditors look at first.
Req 3Protect stored account data
KMS key rotation and key protection tests
Req 4Encrypt data in transit
TLS and HTTPS tests on AWS, S3 and Cloudflare
Req 8Authenticate access
MFA, password and inactive-account tests across your identity tools
Req 10Log and monitor access
CloudTrail tests: turned on, validated and retained
Req 11Test security regularly
GuardDuty tests, web app scans between pen tests, and the ASV scan reports you upload
Req 12Security policy and people
Policy library, acknowledgments, training and background checks
How long does PCI DSS take?
About 4 to 8 weeks
For a self-assessment (SAQ). A Level 1 assessment by a QSA takes about 4 to 8 months.
Step 1
Set scope
About 1 week
Step 2
Fix gaps
1 to 4 weeks
Step 3
ASV scan if needed
1 to 2 weeks
Step 4
SAQ and AOC
About 1 week
Frequently asked questions
Are you an Approved Scanning Vendor (ASV)?
No. Strac Comply's vulnerability scanning is not an ASV scan. It does not replace the internal quarterly scans of Requirement 11.3.1 either.
If your SAQ or ROC includes quarterly external scans (11.3.2), run them with a PCI-approved scanning vendor. Upload each report to its place in your PCI documents. It goes to your auditor with the rest of your evidence.
When you connect your cloud, Strac Comply also keeps the register of public IPs and hostnames your ASV should scan.
Do you help with every PCI DSS level?
Yes. Pick your SAQ, from SAQ A to SAQ D, and Strac Comply scopes your controls to it.
Level 1 merchants need a QSA-led audit, and they use the same evidence. Your QSA reviews it in the auditor portal.
How do you handle Targeted Risk Analyses and compensating controls?
PCI DSS v4.0.1 asks for a Targeted Risk Analysis wherever you set your own frequency or use the customized approach. It asks for a compensating control worksheet wherever you meet a requirement another way. Strac Comply keeps each one next to the requirement it supports, so your QSA sees them together.
Can Strac find card numbers where they shouldn't be?
Yes, with Strac DLP, which Security-First includes. It finds and redacts card numbers in places like Slack, email and support tickets. Its findings don't flow into Strac Comply as evidence yet, so think of it as protection, not proof.
Also in Strac Comply
Get PCI DSS done without a last-minute rush.
Connect your systems, and your PCI DSS tests run today.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations