Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
Your payment providers are in scope too. Coverbase helps you manage them.
PCI DSS requires anyone handling cardholder data to manage their third-party service providers: keep a list, contract for security, and monitor each provider's compliance. With v4.x's future-dated requirements now mandatory, the third-party expectations are firmer than ever. Coverbase runs that program.
CoverbasePCI DSS | provider scope
PCI DSS | provider scope
A provider changes access
Account data
Service scope
Responsibility terms
Agent work
01Map the exposure
02Check the agreement
03Schedule status review
Provider review updated
Your assessor sees who owns each control.
What PCI DSS is and who it applies to
PCI DSS is a contractual standard from the PCI Security Standards Council, not a law. The payment brands and acquiring banks enforce it. It applies to any merchant or service provider that stores, processes, or transmits cardholder data. The current version is v4.0.1, and v4.x's future-dated requirements became mandatory on March 31, 2025.
What PCI DSS asks of you (Req. 12.8)
- 01
A list of service providers
Maintain an inventory of third-party service providers that store, process, or transmit account data, or could affect its security. - 02
Written agreements
Have agreements where providers acknowledge responsibility for the cardholder data they handle. - 03
Due diligence and monitoring
Vet providers before engaging them and monitor their PCI DSS compliance status. - 04
A clear responsibility split
Document which PCI requirements each party manages.
Manage your service providers without the spreadsheet
Requirement 12.8 is a vendor-management program in disguise. Coverbase gives you the inventory, agreements, and monitoring it asks for.
Provider inventory
Keep a current list of service providers and the account data they store, process, transmit, or could affect.Responsibility matrix
Track which requirements each provider is responsible for.Compliance status tracked
Request and track providers' Attestations of Compliance (AOCs) and PCI DSS status.Continuous monitoring
Watch providers between assessments, not once a year.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
PCI provider questions
Scope depends on what the provider can affect.
Is PCI DSS a law?
No. It is an industry security standard; payment brands and acquiring banks set validation requirements.
Does 12.8 cover only vendors storing card data?
No. It also covers providers that could affect the security of account data or your cardholder data environment.
Does a validated provider make us compliant?
No. We connect the provider review and responsibility split; your entity and its assessor determine your applicable requirements.