---
title: Introducing the PCI Blueprint
description: Implement your own PCI-compliant cardholder infrastructure in as little as five minutes with the PCI blueprint.
image: https://blog.basistheory.com/hubfs/Imported_Blog_Media/6355d40b41400ed14ccef524_PCI%20Blueprint.jpg
---

[Skip to content](https://blog.basistheory.com/introducing-the-pci-blueprint#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 October 24, 2022

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[Product](https://blog.basistheory.com/tag/product)

# Introducing the PCI Blueprint

![introducing the PCI blueprint](https://blog.basistheory.com/hubfs/Imported_Blog_Media/6355d40b41400ed14ccef524_PCI%20Blueprint.jpg)

The more control and access organizations have over their data, the faster they can ship, innovate, and react. But, because of the burdens that come with PCI, we’ve seen teams struggle to use their cardholder data to achieve this kind of agility. This makes it difficult to add or leave their payment service providers (PSP) and unlock new partnerships, products, and insights. 

It’s understandable. Cardholder data is a nightmare. Standing up a PCI infrastructure can take months, with annual PCI assessments costing anywhere from [$20,000 to over $500,000](https://secureframe.com/blog/pci-dss-compliance-costs). More importantly, these investments add little value to a company’s core product. 

This is where [tokenization](https://blog.basistheory.com/what-is-tokenization) can help. By generating and using tokens to replace cardholder data in your environment, tokenization reduces or eliminates PCI scope from an organization’s systems while maintaining its ability to collect card data, facilitate payment processing, or search Primary Account Numbers (PAN), and much more.

If companies want to own and use cardholder data without handcuffing themselves to a PSP, they’ll need a simple, affordable, and quick path to doing so. 

## Breaking down a PCI Blueprint

A PCI Blueprint provides an organization with the PCI infrastructure it needs to collect, store, and send cardholder data to a PSP, including:

- A [PCI Level 1](https://blog.basistheory.com/pci-compliance-levels) cardholder environment for securing payment information; 
- Customizable [UI components](https://blog.basistheory.com/elements-capture-secure-tokenize-data) for capturing (or revealing) cards within your application;
- [Token](https://blog.basistheory.com/tokens-protect-use-sensitive-data) properties and capabilities for unlocking multiple different payment operations (e.g. searching, deduplication, and more);
- Dynamic [proxy service](https://developers.basistheory.com/concepts/what-is-the-proxy/) to routing payment information to and from PSPs; and
- [Access controls](https://developers.basistheory.com/concepts/access-controls/) to control access to your sensitive information 

To “easy button” this, the PCI Blueprint’s documentation provides working code samples and an example application, allowing developers to spin up a cardholder infrastructure in less time than it takes to run your daily standup. 

[View the PCI Blueprint developer guide](https://developers.basistheory.com/blueprints/pci).

Let’s take a closer look at some of the concepts powering a PCI Blueprint.

### Templates: Build-to-spec or build-to-suit, fast

Basis Theory’s platform abstracts the hard stuff, like encryption, PCI controls, and key management, while allowing developers to tailor almost any aspect of their implementation. While that flexibility ensures you have the level of control you need today (or tomorrow), it can also be overwhelming for developers unfamiliar with PCI compliance requirements. So how do you fast-track the implementation of such a flexible offering without being a compliance expert yourself? 

We’ve preconfigured the primary components that make up a Basis Theory card implementation. The best thing about these Templates is that they are configurable, giving developers a powerful foundation to further tailor their implementation. 

### Maintain existing operations or unlock new ones with Basis Theory Services

Locking up cardholder data is easy; using it without exposing yourself to PCI scope is hard. We’ve built several services to help. 

**Route and transform payment data with any endpoint using Proxy**

Companies need a way to route cardholder information to and from the Basis Theory environment. Proxy, a service used to send, receive, and transform payloads to and from any processor (or endpoint, for that matter), allows developers to seamlessly inject Basis Theory into their existing payment stack or add new PSPs—all without disrupting internal or external operations. 

Proxy can also run detokenization, tokenization, and transformation operations against the cardholder data inside Basis Theory’s environment. This makes it ideal for tokenizing incoming PANs from third parties, migrating data between databases with two different schemas, or manipulating data before sending it to another endpoint. 

**Search and deduplicate cardholder data without decrypting it**

Whether you’re building a customer service support tool or a loyalty application, you’ll likely need portions of the raw PAN to enable business operations. For example, an application may need to use a PAN’s last 4-digits to confirm a purchase or identify a shared credit card used by multiple family members. 

Developers can support these and many other operations by defining a token's properties, like its Containers, Search Indexes, and Fingerprint properties and using Basis Theory’s Search and Deduplication services available via its web portal or API—all without decrypting the underlying value.

## Need to go the extra mile with PCI Level 1 compliance?

PCI Level 1 is the highest and most cost-intensive tier of PCI compliance. While many organizations using PCI Blueprint won’t require this level of compliance, there are many reasons you may need or want to earn PCI Level 1 certification. Fortunately, Basis Theory provides organizations with the infrastructure and controls needed to satisfy nearly 95% of the PCI Level 1 controls assessed by QSAs during an assessment.  

Need to go faster? That’s where our [partners at Secureframe](https://secureframe.com/blog/basis-theory-partnership) can help. Secureframe provides an all-in-one platform for managing, automating, and tracking the governance, risk, and compliance (GRC) tasks and artifacts needed to achieve and maintain compliance. 

Audits are another area where Basis Theory and Secureframe can help. Typically, systems analysis and evidence gathering can take months of back and forth before a company receives its AOC from a Qualified Security Assessor (QSA). By partnering with QSA firms, like [Prescient Security](https://www.prescientsecurity.com/), to familiarize them with our platforms, we’ve begun helping organizations receive their AOCs faster and for less cost. It’s never been faster, simpler, and more affordable to prove your security and compliance posture. 

Learn more about our partnership with [Secureframe](https://go.basistheory.com/partners/secureframe).

## How to get started?

If you’re an engineer, here’s the recommended order of operations: 

1. [**Sign up for free**](https://portal.basistheory.com/register). In less than 30-seconds, you’ll have your own PCI Level 1 environment. 
2. **Follow the** [**PCI Blueprint**](https://developers.basistheory.com/blueprints/pci). Follow the guide, working code samples, and example application to get a compliant solution stood up in as little as 5 minutes. 
3. **Join our** [**Slack community**](https://basis-theory.slack.com). Ask questions, give feedback, or request new features or capabilities in our growing Slack community. 

If you’re on the non-technical side, [let us help with your discovery](https://basistheory.com/contact). We can provide simple and immediate answers you might have regarding the platform and our partnerships. 

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLI%2BzgkJYjiHY3zc1FIvpvbfUzqulXV%2BiyFcy9YJ4MntwU1Ro4eE2eXfILfvGBqIaPSTMFNQT3O1LTtk8WZse5%2FeZRLFCurmMZDInxgs1YQ1XGwz8nLkVHIMcDCMIdsGg9dJEP0h%2BANxpYZbMm2KJ%2FJdbNyI9sm8CcyK7u13GQxNhxRIwWoBuaWAWKrB1UobD4cLjOVJ1kNmoHO3mZZ43nd373w%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![The are three primary steps of PCI DSS attestation 1) Assess, 2) Remediate, and 3) submit. In step 1, you'll complete either a self-assessment questionnaire (SAQ) or a report on compliance (ROC), depending on your merchat PCI level. Step 2 will require you to remediate any gaps discovered in your assessment. Step 3 will require the assessor to create and submit their assessment and an Attestation of Compliance (AOC) to their payment providers and banking parters.](https://blog.basistheory.com/hubfs/What%20are%20the%20PCI%20DSS%E2%80%99%20ROC%2c%20SAQ%2c%20and%20AOC.jpeg)](https://blog.basistheory.com/pci-dss-roc-saq-aoc)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [What are the PCI DSS’ ROC, SAQ, and AOC?](https://blog.basistheory.com/pci-dss-roc-saq-aoc)

![Picture of Jordan Lampe](https://blog.basistheory.com/hs-fs/hubfs/Imported_Blog_Media/61f0194b9463877ad90ecb1f_jordan-lampe.png?width=50&name=61f0194b9463877ad90ecb1f_jordan-lampe.png) [Jordan Lampe](https://blog.basistheory.com/author/jordan-lampe) 

 January 25, 2023

[Read more](https://blog.basistheory.com/pci-dss-roc-saq-aoc)

[![what is PCI compliance?](https://blog.basistheory.com/hubfs/Imported_Blog_Media/6388c6ad1d41f576264c74da_What%20is%20PCI%20Compliance_%20%20The%2012%20Requirements%20%20%26%20PCI%20DSS%20Guide.jpg)](https://blog.basistheory.com/pci-compliance-12-requirements-pci-dss-guide)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [What is PCI Compliance? The 12 Requirements & PCI DSS Guide](https://blog.basistheory.com/pci-compliance-12-requirements-pci-dss-guide)

![Picture of Jordan Lampe](https://blog.basistheory.com/hs-fs/hubfs/Imported_Blog_Media/61f0194b9463877ad90ecb1f_jordan-lampe.png?width=50&name=61f0194b9463877ad90ecb1f_jordan-lampe.png) [Jordan Lampe](https://blog.basistheory.com/author/jordan-lampe) 

 December 1, 2022

[Read more](https://blog.basistheory.com/pci-compliance-12-requirements-pci-dss-guide)

[![Preparing for PCI in 2025: What best practices are becoming requirements?](https://blog.basistheory.com/hubfs/2025%20PCI%20Requirement%20update.png)](https://blog.basistheory.com/pci-requirements-in-2025)

[Compliance](https://blog.basistheory.com/tag/compliance)

### [PCI 4.0 in 2025: What best practices are becoming requirements?](https://blog.basistheory.com/pci-requirements-in-2025)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 November 6, 2024

[Read more](https://blog.basistheory.com/pci-requirements-in-2025)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2025-12-30T21:49:00.935Z",
  "datePublished" : "2022-10-24T04:00:00.000Z",
  "headline" : "Introducing the PCI Blueprint",
  "image" : [ "https://blog.basistheory.com/hubfs/Imported_Blog_Media/6355d40b41400ed14ccef524_PCI%20Blueprint.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/introducing-the-pci-blueprint",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```