Pci Compliance

# NEVER STORE THESEPROHIBITED_DATA = {    'full_track_data': 'Magnetic stripe data',    'cvv': 'Card verification code/value',    'pin': 'PIN or PIN block'}
# CAN STORE (if encrypted)ALLOWED_DATA = {    'pan': 'Primary Account Number (card number)',    'cardholder_name': 'Name on card',    'expiration_date': 'Card expiration',    'service_code': 'Service code'}
class PaymentData:    """Safe payment data handling."""
    def __init__(self):        self.prohibited_fields = ['cvv', 'cvv2', 'cvc', 'pin']
    def sanitize_log(self, data):        """Remove sensitive data from logs."""        sanitized = data.copy()
        # Mask PAN        if 'card_number' in sanitized:            card = sanitized['card_number']            sanitized['card_number'] = f"{card[:6]}{'*' * (len(card) - 10)}{card[-4:]}"
        # Remove prohibited data        for field in self.prohibited_fields:            sanitized.pop(field, None)
        return sanitized
    def validate_no_prohibited_storage(self, data):        """Ensure no prohibited data is being stored."""        for field in self.prohibited_fields:            if field in data:                raise SecurityError(f"Attempting to store prohibited field: {field}")

import stripe
class TokenizedPayment:    """Handle payments using tokens (no card data on server)."""
    @staticmethod    def create_payment_method_token(card_details):        """Create token from card details (client-side only)."""        # THIS SHOULD ONLY BE DONE CLIENT-SIDE WITH STRIPE.JS        # NEVER send card details to your server
        """        // Frontend JavaScript        const stripe = Stripe('pk_...');
        const {token, error} = await stripe.createToken({            card: {                number: '4242424242424242',                exp_month: 12,                exp_year: 2024,                cvc: '123'            }        });
        // Send token.id to server (NOT card details)        """        pass
    @staticmethod    def charge_with_token(token_id, amount):        """Charge using token (server-side)."""        # Your server only sees the token, never the card number        stripe.api_key = "sk_..."
        charge = stripe.Charge.create(            amount=amount,            currency="usd",            source=token_id,  # Token instead of card details            description="Payment"        )
        return charge
    @staticmethod    def store_payment_method(customer_id, payment_method_token):        """Store payment method as token for future use."""        stripe.Customer.modify(            customer_id,            source=payment_method_token        )
        # Store only customer_id and payment_method_id in your database        # NEVER store actual card details        return {            'customer_id': customer_id,            'has_payment_method': True            # DO NOT store: card number, CVV, etc.        }

import secretsfrom cryptography.fernet import Fernet
class TokenVault:    """Secure token vault for card data (if you must store it)."""
    def __init__(self, encryption_key):        self.cipher = Fernet(encryption_key)        self.vault = {}  # In production: use encrypted database
    def tokenize(self, card_data):        """Convert card data to token."""        # Generate secure random token        token = secrets.token_urlsafe(32)
        # Encrypt card data        encrypted = self.cipher.encrypt(json.dumps(card_data).encode())
        # Store token -> encrypted data mapping        self.vault[token] = encrypted
        return token
    def detokenize(self, token):        """Retrieve card data from token."""        encrypted = self.vault.get(token)        if not encrypted:            raise ValueError("Token not found")
        # Decrypt        decrypted = self.cipher.decrypt(encrypted)        return json.loads(decrypted.decode())
    def delete_token(self, token):        """Remove token from vault."""        self.vault.pop(token, None)

from cryptography.hazmat.primitives.ciphers.aead import AESGCMimport os
class EncryptedStorage:    """Encrypt data at rest using AES-256-GCM."""
    def __init__(self, encryption_key):        """Initialize with 256-bit key."""        self.key = encryption_key  # Must be 32 bytes
    def encrypt(self, plaintext):        """Encrypt data."""        # Generate random nonce        nonce = os.urandom(12)
        # Encrypt        aesgcm = AESGCM(self.key)        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)
        # Return nonce + ciphertext        return nonce + ciphertext
    def decrypt(self, encrypted_data):        """Decrypt data."""        # Extract nonce and ciphertext        nonce = encrypted_data[:12]        ciphertext = encrypted_data[12:]
        # Decrypt        aesgcm = AESGCM(self.key)        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
        return plaintext.decode()
# Usagestorage = EncryptedStorage(os.urandom(32))encrypted_pan = storage.encrypt("4242424242424242")# Store encrypted_pan in database

# Always use TLS 1.2 or higher# Flask/Django exampleapp.config['SESSION_COOKIE_SECURE'] = True  # HTTPS onlyapp.config['SESSION_COOKIE_HTTPONLY'] = Trueapp.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
# Enforce HTTPSfrom flask_talisman import TalismanTalisman(app, force_https=True)