Ask for a walkthrough
Menu

Security compliance software · for firms that take card payments

See what your auditor will see.

Normatiq makes two tools for firms that take card payments. One finds where your card data is. The other shows where you stand on PCI DSS, before your assessor asks.

Ask for a walkthroughSee the two tools

Normatiq does not perform PCI DSS assessments or issue Reports on Compliance. Your QSA does.

Sensitive data foundExample
File share · finance/exports214 card numbers in 6 spreadsheetsCard data
File share · hr/leavers1,240 records with names and addressesPersonal data
File share · clinic/referrals38 documents with health detailsHealth data
3 locationscard data · personal data · health data
Readiness by requirement · PCI DSS v4.0.1Example
12.5.2PCI DSS scope is documented and confirmed every 12 monthsScope confirmed by you on 2 Sep 2026 · 14 systems in scope, 3 connectedIn place
8.4.2Multi-factor authentication (MFA) for all non-console access into the cardholder data environment3 accounts without itNot in place
11.6.1Changes to payment pages are detected and reportedNeeds evidence from youNot checked
Wording paraphrased from PCI DSS v4.0.11 in place · 1 not in place · 1 not checked
Data discovery findsCard data · personal data · health data
on file shares, servers and directory-joined networks
The platform checksPCI DSS v4.0.1 · Cyber Essentials v3.3 (April 2026)
on Amazon Web Services, Microsoft Azure, Google Cloud, Alibaba Cloud
Planned extensionsISO/IEC 27001:2022 · SOC 2 · NIST Cybersecurity Framework 2.0 · DORA · NIS2 and others

Normatiq Ltd · Company number 17510693 · Registered in England and WalesNot an assessor · Not a certification body

1 · Data discovery

Find where your card data is.

The discovery tool looks across file shares, servers and directory-joined networks, and shows where card data, personal data and health data were found.

PCI DSS asks you to confirm where your card data is at least once every 12 months (12.5.2).

Data discovery

Sensitive data foundExample
File share · finance/exports214 card numbers in 6 spreadsheetsCard data
File share · hr/leavers1,240 records with names and addressesPersonal data
File share · clinic/referrals38 documents with health detailsHealth data
Server · support-archive37 card numbers in 4 text filesCard data
Server · payments-db-backupCard numbers, where you expected themCard data
5 locationscard data · personal data · health data

2 · Scope

Know your scope before the audit.

The platform sorts your systems into in scope, connected and out of scope, and draws it as a diagram. You confirm it and your QSA validates it.

The platform

Scope · PCI DSS v4.0.1Example
In scope14
  • payments-api
  • card-vault
  • tokeniser
  • and 11 more
Connected3
  • admin access
  • deploy pipeline
  • log store
Out of scope22
  • marketing site
  • data warehouse
  • and 20 more
Cardholder data environmentConnectedOut of scopeadmin accessdeploy pipelinelog storepayments-apicard-vaulttokeniserand 11 moremarketing sitedata warehouseand 20 more

3 · Each requirement

Find the gaps before the audit does.

Every result is tied to a numbered requirement. What the platform could not check is marked not checked. It is never shown as a pass.

8.4.2 · PCI DSS v4.0.1Example
What it asks for
Multi-factor authentication (MFA) for all non-console access into the cardholder data environment
From your cloud accounts
3 accounts without it
Added by you
Access control policy
Where you stand
Not in place
In placeNot in placeNot checked

4 · The hand-over

No more folders of screenshots.

What the platform finds in your cloud accounts and the documents you add sit under the requirement they answer. Your QSA tests it and decides what to accept.

Evidence by requirement · PCI DSS v4.0.1Example
12.5.2From your cloud accountsAdded by youIn place
1.2.5From your cloud accountsAdded by youNot in place
8.4.2From your cloud accountsAdded by youNot in place
10.4.1.1From your cloud accountsIn place
11.6.1Waiting for your evidenceNot checked

From the assessor's side of the table

Why evidence gets sent back.

Three reasons evidence comes back in the first round.

  • 1It does not cover the scope.
  • 2It has no date or source.
  • 3It is a policy with no proof.

The limits

What Normatiq does not do.

  • Assess you

    Your QSA does.

  • Decide your scope

    You confirm it. Your QSA validates it.

  • Change your cloud accounts

    The platform observes. It does not alter.

  • Certify you

    For Cyber Essentials, a certification body does.

Who is behind it

Built from what auditors ask for.

Normatiq was founded by a practitioner who has led PCI DSS assessments since 2018.

About Normatiq

The companyCompanies House
Registered name
NORMATIQ LTD
Company number
17510693
Registered in
England and Wales
Incorporated
9 October 2026

See it on your own case.

Ask for a walkthrough and we will show you the platform against a scope like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.