This document discusses moving a growth product engineering service out of PCI compliance. It describes orchestrating user data from backend services through a middle tier API service for user signup flows. The new system architecture uses client-side encryption with a public key to keep sensitive data like payment information encrypted. Moving to this new architecture took longer than initially estimated due to unexpected issues like integrating a JavaScript dependency, tuning a third party encryption library, and adjusting various system parameters.

1. Escape From PCI Land
Rahul Dani
Growth Product Engineering

2. The PCI RedemptionPCI

3. Growth Product Engineering Charter
Drive Signup
– Middle tier service
– Flow control, user state management, pre-signup
session management via restful APIs
– Orchestrate data from backend services
• payments, subscriber, account, billing etc.

4. Edge
Service
M1
Payment
s AppMn
Browser
/Device
Company Infrastructure
Billing
App
Browser
/Device
Browser
/Device
Sensitive data
Sensitive data
Billing
AppBilling
App
Payment
s AppPayment
s App
Sensitive data
Sensitive data
Mn
Mn
M1
GP
Services
Edge
Service
Edge
Service
In
Scope
Only Middle Tier App in PCI Scope
In
Scope

5. Edge
Service
M1
Payment
s AppMn
Browser
/Device
Company Infrastructure
Billing
App
Browser
/Device
Browser
/Device
Sensitive data
Sensitive data
Billing
AppBilling
App
Payment
s AppPayment
s App
Sensitive data
Sensitive data
Mn
Mn
M1
GP
Services
Edge
Service
Edge
Service
In
Scope
GP Services No Longer in Scope
In
Scope

6. Browser/
Device
2 2
3
Out of
scope
In Scope
Encryption
key
Public
Key
Distro
1
3
Out of band interaction with CDN
Interaction with Netflix
Plaintext
Ciphertext
System Architecture
Client side encryption using public key

7. Surprises happen
Actual Effort >> Initial Estimation
Effort
Estimated
Actual

8. Why did moving out of PCI take so long
• Javascript as a new dependency
• Third party client encryption library
• Retry logic fine tuning
Client side changes
• TTLs and timeout values needed adjustment
• Flow modified
• Error handling
• Logging
System tuning
Differential impact of fraud

9. Questions ?