PCI-DSS encryption documented with AES-256 minimum

PCI-DSS 4.0 Req-3.5 requires that primary account numbers (PANs) stored anywhere be protected with strong cryptography. Without documentation stating the algorithm and key length, a QSA cannot verify compliance — and organizations that delegate card processing to Stripe must still document that delegation explicitly with the processor's PCI certification level. NIST SC-13 requires that cryptographic module usage be documented and approved. A vague security policy that says "we use encryption" fails both standards: the specific algorithm, key length, and applicable data scope must be named. FFIEC examiners reviewing a financial institution's IT controls will request this documentation as a baseline artifact.

Create a docs/pci-dss-compliance.md or add a PCI section to SECURITY.md. The document must name the algorithm, key length, and the scope of cardholder data it covers:

# PCI-DSS 4.0 Encryption Compliance

## Cardholder Data Scope
- Card processing: Delegated to Stripe (PCI DSS Level 1 Service Provider)
- Local storage: None — no PANs, CVVs, or full card data stored in our database
- Reference: Stripe PCI Attestation of Compliance available at stripe.com/docs/security

## Encryption (non-card sensitive data)
- Algorithm: AES-256-GCM (NIST SP 800-38D)
- Key length: 256 bits
- Key management: AWS KMS (automatic annual rotation)
- Data protected: SSNs, account numbers, bank routing numbers

## Last reviewed: 2026-03-01
## Next review: 2027-03-01

If card data is processed directly (not delegated), pursue formal PCI DSS Level 1 or 2 assessment — documentation alone is insufficient.