{"type":"excalidraw","version":2,"source":"https://AwesomeSystemDesign.dev","elements":[{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-1"}],"updated":0,"link":null,"locked":false,"id":"shape-0","type":"rectangle","seed":41,"x":16,"y":16,"width":288,"height":465,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-1","type":"text","seed":114,"x":36,"y":34,"width":248,"height":429,"fontSize":22,"fontFamily":1,"text":"Non-PCI Zone\n(Everything else)\n\n• Only sees tokens\n(pm_card_visa_424\n2)\n• Cannot reverse\ntoken\nto card number\n• Dramatically\nreduces\nPCI audit scope\n\n100+ servers (out of\nscope)","originalText":"Non-PCI Zone\n(Everything else)\n\n• Only sees tokens\n(pm_card_visa_424\n2)\n• Cannot reverse\ntoken\nto card number\n• Dramatically\nreduces\nPCI audit scope\n\n100+ servers (out of\nscope)","textAlign":"left","verticalAlign":"middle","containerId":"shape-0","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-3"}],"updated":0,"link":null,"locked":false,"id":"shape-2","type":"rectangle","seed":187,"x":16,"y":525,"width":288,"height":379.2,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-3","type":"text","seed":260,"x":36,"y":543,"width":248,"height":343.2,"fontSize":22,"fontFamily":1,"text":"PCI Zone\n(Token Vault)\n\n• Receives raw\ncard numbers\n• Encrypts with\nAES-256-GCM\n• Stores in HSM-\nbacked vault\n• Returns token\n\n< 5 servers","originalText":"PCI Zone\n(Token Vault)\n\n• Receives raw\ncard numbers\n• Encrypts with\nAES-256-GCM\n• Stores in HSM-\nbacked vault\n• Returns token\n\n< 5 servers","textAlign":"left","verticalAlign":"middle","containerId":"shape-2","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#a68a53","backgroundColor":"#fff7e6","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-3"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-5"}],"updated":0,"link":null,"locked":false,"id":"shape-4","type":"rectangle","seed":333,"x":16,"y":948.2,"width":288,"height":1694.8,"customData":{"revealStep":3}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-3"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-5","type":"text","seed":406,"x":36,"y":966.2,"width":248,"height":1658.8,"fontSize":22,"fontFamily":1,"text":"PCI DSS Scope\nMinimization via\nTokenization\n\nProblem: Handling raw\ncard numbers (PAN)\nputs entire\ninfrastructure in PCI\nscope → massive\ncompliance burden\n\nSolution: Token Vault\nisolates card data\n\nTokenization flow:\n1. Client (browser)\nsends card to\nStripe.js endpoint\n(card number never\ntouches merchant's\nserver!)\n2. Token Vault\nencrypts + stores →\nreturns token\n\"pm_abc123\"\n3. Merchant uses\ntoken for all\nsubsequent\noperations\n4. On authorization:\nPayment Svc sends\ntoken to Token\nVault\n→ Vault decrypts in\nsecure enclave →\nsends to network\n→ Card number exists\nin memory for <\n100ms\n\nKey management:\n• Master keys stored\nin HSM (Hardware\nSecurity Module)\n• Key rotation every\n90 days (automatic,\nzero-downtime)\n• Envelope encryption:\ndata key encrypts\ncard,\nmaster key encrypts\ndata key\n• Destruction: when\ncard deleted, data\nkey destroyed\n→ encrypted card\ndata becomes\nirrecoverable","originalText":"PCI DSS Scope\nMinimization via\nTokenization\n\nProblem: Handling raw\ncard numbers (PAN)\nputs entire\ninfrastructure in PCI\nscope → massive\ncompliance burden\n\nSolution: Token Vault\nisolates card data\n\nTokenization flow:\n1. Client (browser)\nsends card to\nStripe.js endpoint\n(card number never\ntouches merchant's\nserver!)\n2. Token Vault\nencrypts + stores →\nreturns token\n\"pm_abc123\"\n3. Merchant uses\ntoken for all\nsubsequent\noperations\n4. On authorization:\nPayment Svc sends\ntoken to Token\nVault\n→ Vault decrypts in\nsecure enclave →\nsends to network\n→ Card number exists\nin memory for <\n100ms\n\nKey management:\n• Master keys stored\nin HSM (Hardware\nSecurity Module)\n• Key rotation every\n90 days (automatic,\nzero-downtime)\n• Envelope encryption:\ndata key encrypts\ncard,\nmaster key encrypts\ndata key\n• Destruction: when\ncard deleted, data\nkey destroyed\n→ encrypted card\ndata becomes\nirrecoverable","textAlign":"left","verticalAlign":"middle","containerId":"shape-4","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":3}}],"appState":{"viewBackgroundColor":"#fbfbf8","gridSize":null},"files":{}}