Look, PCI DSS v4.0.1. is not optional if you handle cardholder data. Version 4.0.1. comes down to one requirement: infrastructure-level isolation from everything else.
Reference: PCI Security Standards Council
Requirements Mapping
| PCI DSS Requirement | Description | Rediacc Capability |
|---|---|---|
| Req 1, Network security controls | Install and maintain network security controls | Per-repository iptables rules block all cross-repository traffic. Each repository gets its own loopback IP subnet (/26). |
| Req 2, Secure configurations | Apply secure configurations to all system components | Rediaccfile lifecycle hooks enforce deterministic, reproducible configurations. No default credentials. LUKS keys are operator-generated. |
| Req 3, Protect stored account data | Protect stored account data with encryption | LUKS2 AES-256 encryption on all repository volumes. Encryption is mandatory, not optional. Cryptographic erasure via LUKS key destruction. |
| Req 4, Protect data in transit | Protect cardholder data with strong cryptography during transmission | All remote operations over SSH. Backup transport encrypted end-to-end. No unencrypted data paths. |
| Req 6, Secure development | Develop and maintain secure systems and software | CoW cloning creates isolated test environments without exposing production cardholder data to development networks. Fork-test-promote workflow. |
| Req 7, Restrict access | Restrict access to system components and cardholder data by business need to know | Per-repository Docker daemon sockets. Access to one repository does not grant access to another. SSH key-based authentication. |
| Req 8, Identify users and authenticate | Identify users and authenticate access to system components | SSH key authentication. API tokens with IP binding and scoped permissions. Two-factor authentication (TOTP). |
| Req 9, Restrict physical access | Restrict physical access to cardholder data | Self-hosted: physical security is under your direct control. LUKS encryption renders stolen drives unreadable. |
| Req 10, Log and monitor | Log and monitor all access to system components and cardholder data | 70+ event types (auth, API tokens, config, licensing, machine operations). Admin dashboard and portal with filtering by user, team, type, and date, plus a JSON export for programmatic use. Machine operations also in system logs for defense in depth. |
| Req 12, Organizational policies | Support information security with organizational policies and programs | Self-hosted eliminates third-party processor scope (Req 12.8). Reduces PCI DSS compliance boundary. |
Network Segmentation
PCI DSS leans hard on segmentation. I keep seeing teams layer iptables rules on top of insufficient isolation. That doesn’t work. The teams that pass have segmentation built into the architecture. Rediacc gives you that by default:
- Each repository runs in its own Docker daemon at
/var/run/rediacc/docker-<networkId>.sock - Repositories have isolated loopback IP subnets (127.0.x.x/26, 61 usable IPs per network)
- iptables rules enforced by renet block all cross-daemon traffic
- Containers from different repositories cannot communicate at the network level
A payment processing repository runs on its own Docker daemon and its own loopback subnet, network-isolated from every other application on the same machine. No extra firewall rules to write.
Scope Reduction
Self-hosted Rediacc reduces compliance scope. You don’t need to manually configure network segmentation; it’s automatic by design. Our documentation for this part still needs work, but the isolation is solid.
- No third-party cloud provider in the cardholder data flow
- No SaaS vendor to evaluate under Req 12.8 (third-party service providers)
- Physical security controls are under your direct management
- Encryption keys are stored only in the operator’s local config
Enforcement Cases
Most PCI audit failures come down to one of two things: segmentation that was never properly isolated, or encryption that was never tested against real attacks.
- Heartland Payment Systems (2008): attackers moved laterally across 48 databases due to poor network segmentation, exposing 130 million card numbers. Total cost exceeded $200 million.
- Target (2013): attackers pivoted from an HVAC vendor’s network access to point-of-sale systems due to flat network architecture, capturing 40 million payment cards. Settled for $18.5 million with 47 state AGs.