1. Acceptance of Terms#
By accessing or using PCI Assessments Center (the "platform"), operated by Haumaru Whānau ("we", "our", or "us"), you accept and agree to be bound by these Terms of Service and our Privacy Policy. If you do not agree, do not use the platform.
2. Services Description#
PCI Assessments Center is a free platform that provides:
- An SAQ selector aligned to the official PCI SSC decision tree.
- Self-assessment workflows for all 10 PCI DSS v4.0.1 Self-Assessment Questionnaires.
- Generation of SAQ response PDFs and Attestations of Compliance (AoCs) from your inputs.
- Training modules and readiness content for PCIP and PCI QSA candidates.
Not a QSA-issued assessment
PCI Assessments Center helps you complete self-assessments. The SAQ and AoC PDFs generated by the platform are self-attested by you and are not a Report on Compliance (ROC) or a QSA-signed attestation. A formal QSA engagement with Haumaru Whānau (or another QSA Company) is required for QSA-signed deliverables.
3. Accounts and User Obligations#
When using PCI Assessments Center you agree to:
- Provide accurate and complete information at sign-up and in your assessments.
- Keep your account credentials confidential and notify us of suspected unauthorised access.
- Use the platform only for lawful purposes and in accordance with applicable PCI SSC guidance.
- Not interfere with, disrupt, or attempt to gain unauthorised access to the platform or other tenants' data.
- Not upload cardholder data, authentication data, or other sensitive personal data into free-text fields.
4. Security Testing and Responsible Disclosure#
We welcome security research. This section is binding on anyone who probes, tests or analyses the platform, whether or not they intend to report a finding. Operational detail — in-scope properties, report contents and response timelines — lives in our responsible disclosure policy; where the two differ, these Terms govern.
Authorised testing. Testing is permitted only against the in-scope properties listed in the disclosure policy, only against accounts, workspaces and data you own or created yourself for the test, and only in the manner described below. Any other testing is unauthorised access.
Testing tenant isolation. Cross-tenant and access-control testing is welcome, but it must be carried out between workspaces you created yourself. Register your own second workspace with your own accounts and your own synthetic test data, then attempt to reach one from the other. A cross-tenant flaw is demonstrated by showing that your own workspace A can reach your own workspace B — never by reading, exporting or modifying data belonging to anyone else. Never use a real customer's workspace, account or data as a target. Creating a small number of test workspaces for this purpose is permitted; bulk or automated account creation is not.
Prohibited without exception
- Read, access, export, alter, corrupt or delete any data belonging to another user, workspace or tenant. If a flaw exposes data that is not yours, stop at the moment you can tell it is not yours, read no further, and report it — never write, never delete.
- Tamper with, disable or attempt to bypass audit logging, the activity ledger, backups or any security control, or take any step intended to conceal your activity.
- Conduct denial of service, volumetric or stress testing, mass automated scanning, or anything that degrades the service for other users.
- Create bulk or synthetic accounts, flood invitations, or exhaust email or other shared quotas.
- Establish persistence — planting accounts, sessions, webhooks, files or stored payloads — or pivot, escalate or continue beyond the minimum needed for a proof of concept.
- Conduct social engineering or phishing, or physical attacks against our staff, customers or suppliers.
- Upload live cardholder data, authentication data or another person's personal data, or publish, share or retain any data you encounter.
Required conduct. Stop as soon as you have a proof of concept, retain no third-party data, report the finding promptly through the disclosure channel, and keep it confidential until we confirm remediation.
Safe harbour and its limits
Good-faith research that follows this section will not result in legal action or a law-enforcement referral from us. Safe harbour does not extend to destructive or coercive acts — deleting, corrupting or tampering with other users' data, extortion, or publication of data obtained from the platform. Those are treated as an attack, not research.
Monitoring and enforcement. Access and actions on the platform are recorded in an append-only audit trail. Automated abuse controls may warn, rate-limit, lock or suspend an account, workspace or network without prior notice, and suspensions issued for abuse are not reversible on request. We reserve the right to pursue civil or criminal remedies and to notify affected customers, partners and regulators where data belonging to others has been accessed or altered.
Recognition, not bounty. Valid reports may be recognised with a verifiable certificate and, at our discretion, swag. We do not operate a paid bounty programme, and submitting a report creates no payment obligation.
5. Accuracy of Attestations#
Each SAQ requires you to confirm the official PCI SSC eligibility criteria before you begin. You are solely responsible for the accuracy and completeness of your eligibility attestations and your responses. PCI Assessments Center records your inputs verbatim in the generated PDFs; it does not validate the truth of those inputs.
6. Intellectual Property#
PCI DSS, the SAQs, the Attestations of Compliance, and related PCI SSC materials are © PCI Security Standards Council, LLC and are used in accordance with the PCI SSC's terms. Platform code, design, training content and other materials on PCI Assessments Center are owned by or licensed to Haumaru Whānau. You retain ownership of the answers, evidence, and generated reports specific to your organisation.
7. Confidentiality#
Assessment data is stored under per-tenant row-level security so only members of your organisation can access it. Please see the Privacy Policy for details on how we handle your data.
8. Limitation of Liability#
To the maximum extent permitted by law, Haumaru Whānau shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenues, data, use, goodwill, or other intangible losses, arising out of or related to your use of the platform.
9. Disclaimers#
The platform is provided "as is" and "as available" without warranties of any kind, either express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, reliability, or completeness. Nothing on the platform constitutes a QSA opinion or legal advice.
10. Indemnification#
You agree to indemnify, defend, and hold harmless Haumaru Whānau and its affiliates, officers, directors, employees, and agents from any claims, liabilities, damages, losses, and expenses arising from your use of the platform or violation of these Terms.
11. Service Modifications and Termination#
We reserve the right to modify, suspend, or discontinue any part of the platform at any time. We may terminate or suspend access to any account that violates these Terms or misuses the platform.
12. Governing Law and Dispute Resolution#
These Terms are governed by the laws of New Zealand. Disputes arising from these Terms or the platform shall be resolved through binding arbitration or in the courts of appropriate jurisdiction in New Zealand.
13. Changes to Terms#
We may modify these Terms from time to time. Material changes will be indicated by updating the "Last updated" date and, where appropriate, by notifying account holders. Continued use of PCI Assessments Center after such changes constitutes acceptance of the new Terms.
14. Contact Information#
For questions about these Terms, contact Haumaru Whānau via the Haumaru contact page or visit haumaru.org.