Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
AI in the payment environment: what the PCI SSC’s new AI guidance means for your scope
The PCI SSC published Security Considerations for AI Systems on 2026-09-15. AI is scoped like any other technology. Where chatbots, agents and shadow AI pull systems into PCI…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →You can’t lose what you don’t keep: reducing PCI scope by not storing card data
The most effective PCI DSS control is often the data you never hold. How hosted payment pages, tokenization and segmentation shrink your cardholder data environment, and the traps…
Read the insight →Which PCI self-assessment questionnaire applies to you? A plain guide for small merchants
A plain-language guide to choosing the right PCI DSS Self-Assessment Questionnaire, including the 2025 changes to SAQ A for e-commerce merchants using embedded payment forms.
Read the insight →Cookies and tracking under Law 25: privacy by default in practice (ss. 8.1 and 9.1)
Section 8.1 governs tracking and profiling technologies; section 9.1 sets privacy by default but excludes cookie settings. Here is how the two fit together on a real website.
Read the insight →The EU’s Digital Omnibus: what proposed GDPR changes could mean for Canadian businesses
The European Commission's Digital Omnibus proposes major GDPR changes, from the definition of personal data to breach deadlines. It is not law yet. Here is what Canadian businesses…
Read the insight →Unattended payments: PCI and device security risks for parking, fuel, EV charging and kiosks
Fuel pumps, parking stations, EV chargers and kiosks face skimming, tampering and network risks. Here is what PCI PTS and PCI DSS require, and practical steps for operators.
Read the insight →Canada’s EU adequacy status and why PIPEDA reform matters to exporters
Canada's EU adequacy status lets European data flow to Canadian businesses with fewer hurdles. It covers PIPEDA only, and federal reform under Bill C-36 is back. What exporters…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.