A payments platform wants to reduce the systems subject to card-data compliance. What actually reduces scope, and what does not?

What actually reduces scope

• Never receiving the card number. A hosted field or an SDK that sends the card directly to a compliant provider means the data never enters your systems. The largest possible reduction, and it is a product decision made at the payment-form design stage rather than an infrastructure one.
• Tokenisation at the earliest possible point, so systems downstream hold a token. The perimeter's size is the dominant cost of the regime — every system inside inherits audit, retention, access control and assessment obligations — so pushing the boundary as far forward as possible is the highest-leverage move.
• Network segmentation that is demonstrable. A segment is only out of scope if connectivity to it is genuinely restricted and that restriction can be evidenced, which requires enforced controls rather than a diagram.
• Removing card data from places it accumulates: logs, error reports, support tooling, analytics, backups, test datasets. These are where scope creeps invisibly, because nobody designed them to hold card data and they do.

What does not reduce scope

• Encrypting it and keeping it. Encrypted card data is still card data, and the system holding it is in scope.
• A policy prohibiting it in logs, without a control that enforces it. A policy someone must remember is not a control, and the failure is silent.
• Segmentation asserted but not enforced, which is discovered during assessment.
• Storing only part of the number, unless it falls within the specific permitted formats — the rules here are precise and intuition is unreliable.

The architectural consequence of getting it right

A small, well-defined perimeter with a clear boundary means the compliance obligations apply to a handful of systems that were designed for them, rather than to a sprawling estate that acquired them accidentally.

That difference is the compliance programme's entire cost structure, and it is determined by architectural decisions rather than by the assessment.

The control that keeps it small

Automated detection of card data outside the perimeter — scanning logs, datastores and non-production environments — with an alert and an owner. Scope creeps continuously, and the only thing that stops it is detection rather than policy.