Compliance · PCI DSS
PCI DSS Media Handling and Offsite Custody
PCI has explicit expectations about physical media: secure storage, controlled distribution, logged movement, and destruction when the data is no longer needed. That maps to custody more directly than most frameworks do.
Bring your retention schedule. We will tell you what it actually costs to meet it.
Read this first. This page is general background on how physical custody supports a compliance programme. It isnot legal advice, it does not state retention periods, and it does not certify that any arrangement satisfies any rule. Requirements change and vary by firm. Get the answer from your own counsel or compliance officer, then tell us what you need us to do.
Scope
Who this applies to
Any business that stores, processes, or transmits cardholder data — and the service providers supporting them.
The recurring themes
- Physical security of media containing cardholder data.
- Control and logging of media distribution and movement.
- Approval before media leaves a secured area.
- Destruction of media when it is no longer needed for business or legal reasons.
Our part
What custody actually contributes
- Secured physical storage in a 9R vault with man-trap entry.
- Scanned, timestamped logs for every movement in and out.
- Named authorised parties, so distribution is controlled rather than ad hoc.
- Witnessed physical destruction with serialised certificates.
Said plainly
What we do not do
Storage is one requirement among many. We do not perform assessments, we are not a QSA, and using us does not make an environment compliant. We never access media contents.
Sectors this usually affects
Common questions
- Are you a QSA?
- No. We are a custodian. Your assessor evaluates your environment.
- Do you log every movement?
- Yes, scanned and timestamped, in and out.
- Is a software wipe acceptable?
- We do not offer one. We do physical destruction because it is verifiable and a wipe certificate is not.
Bring your retention schedule.
We will tell you plainly what custody covers and what it does not. That is a more useful conversation than a compliance claim.