PCI Compliance

The Payment Card Industry Data Security Standard (PCI DSS) defines security standards for organizations that handle payment card information.

PCI Compliance for Oracle Payment Cloud Service

Oracle acts as a payment facilitator for Oracle Payment Cloud Service. Oracle does not store or process card data. The cardholder data environment (CDE), primary account number (PAN), and other PCI-regulated information are processed by Oracle’s payment acquirer, Adyen. Therefore, Oracle is not required to provide an Attestation of Compliance (AoC) for Oracle Payment Cloud Service.

A copy of Adyen’s AoC, along with a responsibility matrix for Oracle core products such as OPERA, Simphony, and X-Store, can be provided upon request.

E2EE and P2PE for Oracle Payment Cloud Service

Unless otherwise stated in your initial order document, all Oracle Payment Cloud Service instances are installed with end-to-end encryption (E2EE) by default.

Point-to-point encryption (P2PE) is available upon request and at an additional cost. Consult your sales manager if you are interested in P2PE. For more information, see PCI Security Standards Council P2PE solutions.

Frequently Asked Questions

Can Oracle advise whether my business is PCI compliant?

No. Oracle cannot advise whether your business meets PCI requirements. Only a qualified PCI consultant or assessor can advise whether your business is PCI compliant.

Can Oracle act as a consultant to help me meet PCI responsibilities?

No. Oracle is not an approved PCI consultant or auditor. Consult a PCI regulatory expert about your requirements. For Oracle-approved referrals, see the Cloud Security Testers List.

How does Oracle meet PCI requirements?

Oracle follows the PCI Software Security Framework (SSF) program for its software development lifecycle, which is validated by a PCI-qualified third party. For listed Oracle products, see the PCI Security Standards Council software lifecycle listings. Oracle also has a robust process for tracking open-source components and their known vulnerabilities. Oracle does not release a new product version if it includes a critical vulnerability.

Can Oracle advise which Self-Assessment Questionnaire (SAQ) type applies to my business?

No. Oracle cannot advise which SAQ applies to your business. Your PCI compliance level is determined by factors such as transaction volume and payment interaction types. Consult an approved PCI assessor.