PCI DSS Compliance

9 posts · May 2026 – Jul 2026

What this trail covers

SingleStore Helios and Helios BYOC have achieved PCI DSS v4.0.1 compliance, demonstrating robust security controls for handling payment card data. This includes identity and access management with MFA and SSO, encryption at rest and in transit (TLS 1.2+, AES-256), continuous monitoring of logs, regular vulnerability management, and secure cloud infrastructure on AWS with network segmentation. The compliance covers the managed platform, with shared responsibility for application-level security. This post details the implementation of Zero Trust principles across four pillars: identity verification, access control, network restriction, and data protection, providing concrete controls and technical details for each.

All SingleStore trails

Jul 2026Why ad platforms run six databases to answer one questionThis post analyzes the architectural challenges of ad platforms that lead to data sprawl, where multiple databases are used for different functions, resulting in increased operational costs and complexity. It highlights the shift from traditional batch OLAP and individual OLTP systems to the need for real-time HTAP systems. The post details how this data sprawl arises from specialized databases for auction lookups, advertiser dashboards, audience filtering, and caching, leading to redundant data copies and synchronization issues. It argues that the traditional split between batch and real-time processing incurs significant costs due to data migration, latency, and operational overhead. The post introduces Hybrid Transactional/Analytical Processing (HTAP) as a solution, enabling both high-speed writes and analytical reads within a single engine, thus consolidating diverse workloads and providing a unified freshness profile and single point of access.
Jun 2026Cloud Database Security Engineering and SDLC | SingleStoreThis post elaborates on the engineering practices and SDLC that contribute to SingleStore's PCI DSS compliance. It details the six core practices: security training, threat modeling, security requirements definition, architecture vetting, secure code review, and automated CI/CD testing. It also outlines the specific automated security tests performed on every build (SAST, SCA, DAST, container image scanning, secrets scanning, IaC scanning, CNAPP). Furthermore, it describes external validation methods like annual penetration testing and a responsible disclosure program, and details incident management aligned with NIST SP 800-61.
Jun 2026Cloud Database Shared Responsibility Explained | SingleStoreThis post elaborates on the shared responsibility model for SingleStore Helios, detailing the security controls provided by default by SingleStore (AES-256 encryption at rest, TLS 1.2+ in transit, no public access by default, network isolation, secure credential store) and those that remain the customer's responsibility (IP allowlisting, identity provider integration, RBAC design, Customer-Managed Encryption Keys, application-layer security). It frames the vendor's security posture by the strength of its defaults and provides key questions for vendor due diligence regarding security defaults and boundaries.
Jun 2026Cloud Database Encryption Keys and CMEK | SingleStoreThis post elaborates on the encryption capabilities within SingleStore Helios, specifically detailing the implementation and implications of Customer-Managed Encryption Keys (CMEK). It explains the architecture of CMEK, which involves using a customer-provided Key Encrypting Key (KEK) to encrypt Data Encryption Keys (DEKs) managed by the cloud provider's KMS. The post highlights the technical aspects of how SingleStore interacts with cloud KMS APIs for encryption/decryption operations and emphasizes the critical importance of key management practices for data sovereignty and the risk of data loss if keys are mishandled or deleted. It contrasts CMEK with platform-managed encryption, providing guidance on choosing the appropriate model based on security and regulatory requirements.
May 2026Why Real-Time EdTech Needs Security Built In, Not Bolted OnThis post details the security requirements for EdTech platforms, emphasizing the need for security to be built-in rather than bolted on. It highlights common compliance regulations (FERPA, CCPA, SOC 2, GDPR, HIPAA) and their overlapping requirements: role-based access control (RBAC) at the data tier, multi-tenancy with real isolation, real-time identity management, and comprehensive audit logging. The post uses the PowerSchool breach as a case study and contrasts application-layer access controls with database-layer enforcement, advocating for the latter to ensure principle of least privilege. It references GoGuardian and Curriculum Associates as examples of platforms implementing these principles at scale.
Advertisement
May 2026Zero Trust Isn't a CheckboxThis post elaborates on the Zero Trust security model as implemented in SingleStore Helios, detailing specific technical controls for identity verification (short-lived tokens, mTLS, JWT, cloud IAM integration, workload identity, MFA enforcement), access control (RBAC at portal and database levels, Row-Level Security, JIT access), network restriction (PrivateLink, Private Service Connect, bastion host for SRE access), and data protection (AES-256 at rest platform-managed and customer-managed, TLS 1.2+ in transit, mTLS at transport layer). It also poses critical questions to differentiate genuine Zero Trust architecture from marketing claims.
May 2026Database SSO Integration: SAML, OIDC, SCIM and MFA | SingleStoreThis post details SingleStore Helios's integration with enterprise identity management systems, focusing on SAML 2.0 and OIDC for SSO, SCIM 2.0 for automated user and group provisioning/deprovisioning, and cloud IAM integration (AWS IAM, Azure AD, GCP IAM) for machine identity. It also covers MFA enforcement through the IdP for SSO users and email/TOTP for local accounts. The post outlines a maturity model for identity integration, progressing from local accounts to SSO, SCIM, and machine identity.