Ubitrak is Kerson Wallaw’s audit and certification division, a PCI SSC Qualified Security Assessor (QSA) company since 2011. It assesses PCI DSS and Interac, prepares organizations for ISO 27001 and SOC 2 with partner CPA firms, and tests systems the way attackers would.
One clear mandate, weekly follow-up, no surprises at audit time.
One contract, one point of contact, no finger-pointing between vendors.
Most organizations call an assessor after a client, an acquirer or an incident forces the question. By then the timeline is no longer yours.
Your acquirer can act.
Card brands fine non-compliant merchants through their acquirer, which can raise your fees or close your merchant account.
A breach costs more than an audit.
Forensic investigation, card reissuance, fraud liability, downtime, and mandatory notices to the people affected and to regulators under Law 25 and PIPEDA.
Clients ask before they sign.
Banks, enterprises and governments want a current report before contract signature or renewal. No report, no deal.
The deadlines do not move.
PCI DSS v4.0’s new requirements have been mandatory since 2025-03-31. Validation is yearly; ASV scans are quarterly.
If you wait
- An incident sets the agenda and the budget.
- Evidence is rebuilt in a rush, often twice.
- Contracts stall while clients wait for a report.
- Fines and fees land on top of remediation costs.
With Ubitrak
- You know your scope and gaps before anyone asks.
- Evidence is collected once and reused across frameworks.
- Reports are ready when clients and acquirers need them.
- Every finding is tracked to closure in the audit portal.
The path
- ScopeMap where card and personal data live, and what is in scope.
- AssessQSAs test controls on site and remotely, with plain-language findings.
- FixPrioritized remediation, with KW Consulting if you need hands.
- Certify and keepSigned report, then quarterly scans and yearly renewal on a calendar.
What we cover
- PCI DSS assessments Reports and Attestations of Compliance by QSAs.
- Interac assessments Often combined with PCI DSS so evidence is collected once.
- ISO 27001 readiness Gap assessment before certification.
- SOC 1 and SOC 2 reports Prepared with the partner CPA firms that issue them under CSAE 3416 and CSAE 3000.
- Penetration testing Internal, external, wireless and application tests.
- ASV scans Quarterly external scans, scheduled and tracked.
Each industry page sets out the specific risks and how Ubitrak addresses them.
Payment service providers
Processors, gateways and payment facilitators proving security to card brands, banks and Interac. Learn more →
Financial institutions
Interac and PCI assessments by QSAs who have worked inside banks. Learn more →
Unattended payments
Terminals, service stations, parking and pay stations that nobody is watching. Learn more →
E-commerce
Online merchants and platforms, from dozens of transactions a day to millions. Learn more →
Retail
Multi-store merchants with point-of-sale terminals, loyalty data and annual PCI validation. Learn more →
Travel and hospitality
Travel agents, tour operators, hotels and restaurants meeting IATA and acquirer requirements. Learn more →
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.