DEFINITION
PCI DSS
The Payment Card Industry Data Security Standard — the global security framework that governs how organisations protect cardholder data wherever it is stored, processed, or transmitted.
In depth
PCI DSS is a set of technical and operational requirements published by the PCI Security Standards Council (PCI SSC), a consortium founded by American Express, Discover, JCB, Mastercard, and Visa. It applies to any organisation that stores, processes, or transmits payment card data — merchants, payment processors, issuers, acquirers, and their service providers. Version 4.0 became the sole active standard in April 2024. PCI DSS does not explicitly address generative AI tools, but its existing requirements cover any system or process that touches cardholder data (CHD) or sensitive authentication data (SAD). Pasting a primary account number (PAN), a CVV, or a full transaction record into ChatGPT, Claude, or Gemini almost certainly violates multiple PCI DSS requirements: it transmits CHD outside the cardholder data environment (CDE), to a service provider with no PCI-aligned contract, with no evidence of scope assessment or security controls. Requirement 12.8 extends PCI obligations to service providers, and Requirement 12.3.4 requires annual reviews of all technology — including AI tools used by staff who handle CHD.
Examples
- A developer pasting a test PAN into GitHub Copilot to debug a Luhn-check function — CHD is now on a third-party server with no PCI-compliant agreement.
- A fraud analyst attaching a transaction CSV export to a ChatGPT session to identify anomalies — the full CSV contains real PANs.
- A payments engineer using a coding assistant with codebase indexing enabled on a repository that contains real card-range test data.
How Locke handles pci dss
Locke detects Luhn-valid card numbers (PANs), CVVs, track-data patterns, and transaction identifiers locally before any prompt leaves the device. For payments engineering teams, this provides a technical control that reduces the risk of CHD escaping the CDE through the AI prompt path — the control gap PCI DSS v4.0's customised approach allows organisations to address with novel mechanisms.
See the productRelated terms
- Data Loss Prevention (DLP)
A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.
- Personally Identifiable Information (PII)
Any information that can identify a specific person, either directly (name, SSN) or in combination with other data (zip code + birthdate).
- Shadow AI
Employees using AI tools at work without organisational sanction — the AI-era version of shadow IT.
