{"type":"excalidraw","version":2,"source":"https://AwesomeSystemDesign.dev","elements":[{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-1"}],"updated":0,"link":null,"locked":false,"id":"shape-0","type":"rectangle","seed":41,"x":270.37627999999995,"y":32,"width":306.24232000000006,"height":293.40000000000003,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-1","type":"text","seed":114,"x":290.37627999999995,"y":50,"width":266.24232000000006,"height":257.40000000000003,"fontSize":18,"fontFamily":1,"text":"Non-PCI Zone\n(Everything else)\n\n• Only sees tokens\n(pm_card_visa_4242)\n• Cannot reverse token\nto card number\n• Dramatically reduces\nPCI audit scope\n\n100+ servers (out of scope)","originalText":"Non-PCI Zone\n(Everything else)\n\n• Only sees tokens\n(pm_card_visa_4242)\n• Cannot reverse token\nto card number\n• Dramatically reduces\nPCI audit scope\n\n100+ servers (out of scope)","textAlign":"center","verticalAlign":"middle","containerId":"shape-0","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#628572","backgroundColor":"#edf5ee","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-3"}],"updated":0,"link":null,"locked":false,"id":"shape-2","type":"rectangle","seed":187,"x":35.999999999999986,"y":32,"width":194.37627999999998,"height":316.8,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-3","type":"text","seed":260,"x":55.999999999999986,"y":50,"width":154.37627999999998,"height":280.8,"fontSize":18,"fontFamily":1,"text":"PCI Zone\n(Token Vault)\n\n• Receives raw\ncard numbers\n• Encrypts with\nAES-256-GCM\n• Stores in HSM-\nbacked vault\n• Returns token\n\n< 5 servers","originalText":"PCI Zone\n(Token Vault)\n\n• Receives raw\ncard numbers\n• Encrypts with\nAES-256-GCM\n• Stores in HSM-\nbacked vault\n• Returns token\n\n< 5 servers","textAlign":"center","verticalAlign":"middle","containerId":"shape-2","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#a68a53","backgroundColor":"#fff7e6","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-3"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-5"}],"updated":0,"link":null,"locked":false,"id":"shape-4","type":"rectangle","seed":333,"x":36,"y":388.8,"width":602.07984,"height":544.3,"customData":{"revealStep":3}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-3"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-5","type":"text","seed":406,"x":56,"y":406.79999999999995,"width":562.07984,"height":508.3,"fontSize":17,"fontFamily":1,"text":"PCI DSS Scope Minimization via Tokenization\n\nProblem: Handling raw card numbers (PAN) puts entire\ninfrastructure in PCI scope → massive compliance burden\n\nSolution: Token Vault isolates card data\n\nTokenization flow:\n1. Client (browser) sends card to Stripe.js endpoint\n(card number never touches merchant's server!)\n2. Token Vault encrypts + stores → returns token \"pm_abc123\"\n3. Merchant uses token for all subsequent operations\n4. On authorization: Payment Svc sends token to Token Vault\n→ Vault decrypts in secure enclave → sends to network\n→ Card number exists in memory for < 100ms\n\nKey management:\n• Master keys stored in HSM (Hardware Security Module)\n• Key rotation every 90 days (automatic, zero-downtime)\n• Envelope encryption: data key encrypts card,\nmaster key encrypts data key\n• Destruction: when card deleted, data key destroyed\n→ encrypted card data becomes irrecoverable","originalText":"PCI DSS Scope Minimization via Tokenization\n\nProblem: Handling raw card numbers (PAN) puts entire\ninfrastructure in PCI scope → massive compliance burden\n\nSolution: Token Vault isolates card data\n\nTokenization flow:\n1. Client (browser) sends card to Stripe.js endpoint\n(card number never touches merchant's server!)\n2. Token Vault encrypts + stores → returns token \"pm_abc123\"\n3. Merchant uses token for all subsequent operations\n4. On authorization: Payment Svc sends token to Token Vault\n→ Vault decrypts in secure enclave → sends to network\n→ Card number exists in memory for < 100ms\n\nKey management:\n• Master keys stored in HSM (Hardware Security Module)\n• Key rotation every 90 days (automatic, zero-downtime)\n• Envelope encryption: data key encrypts card,\nmaster key encrypts data key\n• Destruction: when card deleted, data key destroyed\n→ encrypted card data becomes irrecoverable","textAlign":"left","verticalAlign":"middle","containerId":"shape-4","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":3}}],"appState":{"viewBackgroundColor":"#fbfbf8","gridSize":null},"files":{}}