What changed and why it matters for development partner selection
PCI DSS v4.0.1 introduced major changes to how organizations demonstrate compliance. Continuous validation, customized approaches and engineering-led controls now play a central role in fintech development.
Continuous validation
Controls must remain continuously effective rather than being treated as compliant only until the next annual audit. Organizations need ongoing monitoring and validation.
Customized compliance
Organizations can meet the intent of requirements through alternative controls when the approach is documented and supported by targeted risk analysis.
Engineering failures become compliance failures
Insecure architectures, untracked data flows, poorly scoped CDEs and bolted-on authentication can create significant compliance exposure.
Development partner selection matters
A partner that integrates PCI DSS into the software development lifecycle is fundamentally different from one that addresses compliance only after launch.
Understanding CDE scope: the decision that determines cost
Incorrect cardholder data environment scoping can expand the compliance boundary unnecessarily. Systems such as logs, analytics tools, support tickets and data lakes can pull additional components into scope when card data reaches them.
| CDE Scope Level | What puts a system in scope | Development Partner Requirement |
|---|---|---|
|
In-scope
Direct CDE |
Stores, processes or transmits PANs, CVV2, PINs or cardholder names directly. | Full v4.0.1 compliance across all applicable requirements. Scope reduction through tokenization is a high-priority architectural decision. |
|
Connected
Connected-to CDE |
Systems that connect to in-scope components, including APIs, microservices, databases and logging systems. | Security controls, network segmentation and access management that prevent lateral movement from connected systems into the CDE. |
|
Third Party
Integration |
Payment processors, gateways, fraud tools and verification APIs. | Documented evidence that third-party integrations use PCI DSS-compliant service providers, with responsibility clearly defined in contracts. |
|
Scoped Out
Out-of-scope |
Systems with no path to cardholder data and documented network segmentation. | Architecture and network documentation proving isolation. Incorrect scoping can become one of the most expensive audit failure modes. |
PCI DSS v4.0.1 requirement coverage map
The matrix maps 10 development firms against eight PCI DSS coverage areas grouped from the standard's 12 requirement families.
| Company | R1–2 Network |
R3–4 Data |
R5–6 Vuln Mgmt |
R7–9 Access |
R10–11 Monitor |
R12 Policy |
Tokenization | Scheme Cert. |
|---|---|---|---|---|---|---|---|---|
| Kindgeek | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| DBB Software | ✓ | ✓ | ✓ | ✓ | ◐ | ✓ | ✓ | ◐ |
| Computools | ✓ | ✓ | ✓ | ◐ | ◐ | ✓ | ✓ | ✓ |
| Endava | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Saigon Technology | ✓ | ✓ | ✓ | ✓ | ◐ | ✓ | ◐ | – |
| Avenga | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ◐ |
| Oxagile | ✓ | ✓ | ◐ | ✓ | ✓ | ✓ | ✓ | – |
| ScienceSoft | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ◐ | ◐ |
| Itexus | ✓ | ✓ | ✓ | ✓ | ◐ | ✓ | ✓ | ◐ |
| DataArt | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ◐ | ◐ |
The companies behind the comparison
Each firm is positioned according to the PCI DSS capability, engineering evidence and fintech environment highlighted in the guide.
Kindgeek
Kindgeek's PCI DSS compliance posture is documented at the process level, not just the outcome level. Automated PCI DSS exposure checks during code review, continuous compliance validation against PSD2, DORA and GDPR on every pull request, and AI-generated test suites for KYC/AML edge cases are documented as standard engineering workflow. More than 100 shipped fintech products include PCI DSS-compliant card issuing systems with scheme certification through Visa, Mastercard or American Express. Named clients payabl., HyperJar and JAJA are live regulated products that have cleared card scheme certification.
Verified evidence
Automated PCI DSS in CI/CD; payabl., HyperJar and JAJA scheme-certified card products; 100+ PCI DSS-compliant fintech products shipped.
Best suited for
Series B fintech companies building card issuing, payment gateway or digital wallet products where PCI DSS must be a development process attribute.
Less suited for
Non-card payment products without CDE, capital markets or quantitative trading systems, and lending platforms without a card payment component.
DBB Software
DBB Software documents PCI DSS Level 1 compliance as a delivery standard for payment infrastructure work, alongside 3DS 2.0 and Strong Customer Authentication. These standards interact in modern card payment architecture: PCI DSS governs cardholder data protection, 3DS 2.0 governs authentication for card-not-present transactions, and SCA governs the EU requirement for stronger authentication. DBB Software's documented delivery covers merchants, marketplace platforms and cross-border fintechs, while its MiCA capability extends its work into digital asset payment products.
Verified evidence
PCI DSS Level 1 stated with 3DS 2.0 and SCA documentation; merchant, marketplace and cross-border payment delivery.
Best suited for
Series B fintech companies building card payment products in EU markets where PCI DSS, 3DS 2.0 and SCA must be satisfied together.
Less suited for
US-only card products without EU exposure, lending platforms without card payment and non-payment fintech verticals.
Computools
Computools' Caribbean Bank engagement produces one of the most specifically documented PCI DSS deliveries in the guide: Visa microservices implementation with PCI DSS compliance, verified by a named institutional client, with a measured outcome of 12% engagement increase among target user segments. Visa microservices certification requires understanding of the full card scheme authorization flow, including CVV2 handling, PAN tokenization, logging and access controls.
Verified evidence
Caribbean Bank Visa microservices with PCI DSS scheme certification and named institutional client evidence.
Best suited for
Series B fintech companies pursuing Visa or Mastercard scheme certification alongside PCI DSS compliance.
Less suited for
Non-card payment products, open banking, ACH/RTP primary builds and EU products without a US scheme certification requirement.
Endava
Endava's payments practice encompasses the complete PCI DSS compliance surface: merchant experience engineering, PCI DSS-compliant card management, digital authentication, 3DS 2.0 integration and tokenization architecture across multiple payment schemes and geographies. Its scale and publicly listed status make it a delivery partner for large payment infrastructure programs where technical due diligence and compliance governance are significant considerations.
Verified evidence
NYSE-listed payments specialist; full PCI DSS stack across card, 3DS and tokenization; scheme-certified delivery with major networks.
Best suited for
Series B fintech companies building multi-scheme PCI DSS-compliant payment infrastructure at scale.
Less suited for
Small or mid-size engagements where a large enterprise delivery model creates a scale mismatch, and non-payment fintech verticals.
Saigon Technology
Saigon Technology's ISO 27001 certification, accredited by BSI in the UK, establishes an information security management baseline independently of client-specific compliance claims. Its documented fintech delivery includes mobile banking applications, payment processing platforms and AI-driven financial analytics with PCI DSS and KYC/AML compliance stated across its global client base. The guide positions the company as a cost-efficient option for multi-region fintech development.
Verified evidence
BSI-accredited ISO 27001 certification; Origence SVP-named testimonial; global financial-services delivery; $25–50/hr.
Best suited for
Series B fintech companies needing cost-efficient PCI DSS-compliant development with an ISO 27001 baseline.
Less suited for
Major card scheme certification, EU-specific MiCA or PSD3 engineering, and companies requiring US onshore presence.
Avenga
Avenga is unusual among development firms because cybersecurity is an explicit named service line alongside software engineering. Its financial-services catalog includes cybersecurity, banking, data and AI, customer experience and complex financial platforms. The guide highlights 200+ banking and financial services clients and 400+ projects in 24 months, positioning Avenga for environments where security engineering needs to be integrated with broader fintech delivery.
Verified evidence
Cybersecurity as a named service line; 200+ BFS clients; 400+ projects in 24 months; institutional stability.
Best suited for
Series B fintech companies requiring PCI DSS compliance alongside AI-powered fraud detection, cybersecurity operations and data management.
Less suited for
Small-scale engagements where large-firm overhead is a cost constraint, or projects needing primarily consumer UX design.
Oxagile
Oxagile's payment integration documentation explicitly covers PCI DSS, SOC 2, ISO 27001, PSD2 and other compliance standards. Its multi-processor redundancy and automatic failover architecture targets 99.99% uptime. For PCI DSS scope reduction, its tokenization work replaces PANs with tokens before card data reaches client systems, making CDE reduction a central architectural advantage.
Verified evidence
PCI DSS, SOC 2, ISO 27001 and PSD2 stated in payment integration documentation; 99.99% uptime architecture; tokenization delivery.
Best suited for
Fintech companies whose primary PCI DSS challenge is reducing CDE scope through tokenization or maintaining payment availability.
Less suited for
Card scheme certification, full LOS migration and non-payment fintech verticals without CDE.
ScienceSoft
ScienceSoft's PCI DSS delivery is distinguished by its intersection with other compliance standards. Its work spans HIPAA for healthcare payment platforms, state insurance regulations for premium finance products and SOC 2 for enterprise financial services. The guide highlights 35 years of BFSI delivery and positions the firm for payment products where PCI DSS cannot be evaluated independently from another regulated environment.
Verified evidence
35 years of BFSI delivery; HIPAA + PCI DSS dual-compliance for healthcare payment platforms; SOC 2 documentation.
Best suited for
Fintech companies whose payment products intersect with healthcare or insurance compliance.
Less suited for
Consumer payment products without healthcare or insurance intersections, BNPL or embedded finance without regulated vertical context.
Itexus
Itexus's fintech-only portfolio means its PCI DSS experience is focused specifically on financial products. The guide highlights the additional complexity of fintech PCI DSS environments, including KYC/AML integration, FINRA audit trail requirements and credit decision data that needs to remain separate from cardholder data to prevent accidental scope expansion. Its New York presence also supports investor due diligence cycles for US fintechs.
Verified evidence
Fintech-only PCI DSS portfolio; New York US office; documented FINRA/KYC/AML intersection with PCI compliance scope.
Best suited for
US Series B fintech companies building payment systems where PCI DSS must integrate with FINRA audit requirements and KYC/AML flows.
Less suited for
Non-US regulatory builds, healthcare or insurance fintech with HIPAA intersection, and large-scale team augmentation without compliance architecture leadership.
DataArt
DataArt's capital markets history produces PCI DSS experience in high-stakes payment environments. The guide highlights Fedwire and SWIFT settlement systems, securities transaction infrastructure and ISO 20022 messaging architecture. PCI DSS in capital markets environments must coexist with data retention, audit trail and access control requirements associated with financial oversight.
Verified evidence
27 years of capital markets payment compliance; Fedwire and SWIFT settlement context; 4,500+ engineers; ISO 20022 + PCI DSS.
Best suited for
Series B fintech companies serving institutional clients whose payment products include card settlement alongside wire or securities infrastructure.
Less suited for
Consumer payment products, retail fintech without institutional context and open banking or SEPA primary builds.
How the firms were selected
Companies were evaluated on documented PCI DSS delivery, certifications and scheme certification evidence. The guide distinguishes documented evidence from stated capabilities.
Verified PCI DSS delivery through case studies, certifications or certified delivery evidence.
PCI DSS Level 1, ISO 27001 or other relevant security certification evidence.
Visa, Mastercard or other card scheme certification evidence where documented.
Requirement coverage mapped against PCI DSS v4.0.1.
Engineering capabilities around CDE scope, tokenization, access and monitoring.
Differentiated fintech compliance use cases and documented delivery evidence.