Skip to content
flowss
Start freeChecking your session
Data flow diagram templates

DFD — Card Authorisation (PCI DSS)

Level-2 decomposition of card capture, tokenisation, authorisation and settlement, with the PCI cardholder data environment drawn as a trust zone so the 9 flows that enter or leave CDE scope are enumerated.

Data flow diagramRisk & ReliabilityData flow diagram syntax docs
Template previewData flow diagram
Take payment — decomposition of process 3LEVEL 2Public internetPCI cardholder data environmentScheme + banking networkCardholderCard schemeAcquiring bankFraud bureau3.1Capture checkout3.2Tokenise PAN3.3Score fraud risk3.4Authorise payment3.5Settle batch3.6Reconcile payoutD1Order bookD2Token vaultD3Auth log (PCI)D4Settlement filebasket + card detailsorder (4 200/day)PAN + expirytoken / PAN mapvelocity blocklistrisk score 0..100ISO 8583 0100auth result + RRNreceiptcaptured authsnightly batch filesettlement batchexpected totalspayout advicereconciled flagdetokenised PANdevice + basket signals0110 approval codeorder totals4 entities · 6 processes · 4 stores · 19 flows · 9 boundary crossingsCrossing — “basket + card details”: Cardholder (Public internet) → Capture checkout (outside).Crossing — “PAN + expiry”: Capture checkout (outside) → Tokenise PAN (PCI cardholder data environment).Crossing — “risk score 0..100”: Score fraud risk (outside) → Authorise payment (PCI cardholder data environment).Crossing — “ISO 8583 0100”: Authorise payment (PCI cardholder data environment) → Card scheme (Scheme + banking network).Crossing — “0110 approval code”: Card scheme (Scheme + banking network) → Authorise payment (PCI cardholder data environment).Crossing — “receipt”: Authorise payment (PCI cardholder data environment) → Cardholder (Public internet).Crossing — “captured auths”: Auth log (PCI) (PCI cardholder data environment) → Settle batch (outside).Crossing — “settlement batch”: Settle batch (outside) → Acquiring bank (Scheme + banking network).Crossing — “payout advice”: Acquiring bank (Scheme + banking network) → Reconcile payout (outside).

Make it your own.

title "Take payment — decomposition of process 3"
level 2

entity Cardholder
entity "Card scheme"
entity "Acquiring bank"
entity "Fraud bureau"

process 3.1 "Capture checkout"
process 3.2 "Tokenise PAN"
process 3.3 "Score fraud risk"
process 3.4 "Authorise payment"
process 3.5 "Settle batch"
process 3.6 "Reconcile payout"

store D1 "Order book"
store D2 "Token vault"
store D3 "Auth log (PCI)"
store D4 "Settlement file"

boundary "Public internet" { Cardholder }
boundary "PCI cardholder data environment" { 3.2, 3.4, D2, D3 }
boundary "Scheme + banking network" { "Card scheme", "Acquiring bank" }

Cardholder -> 3.1 : "basket + card details"
3.1 -> D1 : "order (4 200/day)"
3.1 -> 3.2 : "PAN + expiry"
3.2 -> D2 : "token / PAN map"
D2 -> 3.4 : "detokenised PAN"
3.1 -> 3.3 : "device + basket signals"
"Fraud bureau" -> 3.3 : "velocity blocklist"
3.3 -> 3.4 : "risk score 0..100"
3.4 -> "Card scheme" : "ISO 8583 0100"
"Card scheme" -> 3.4 : "0110 approval code"
3.4 -> D3 : "auth result + RRN"
3.4 -> Cardholder : "receipt"
D1 -> 3.5 : "order totals"
D3 -> 3.5 : "captured auths"
3.5 -> D4 : "nightly batch file"
3.5 -> "Acquiring bank" : "settlement batch"
D4 -> 3.6 : "expected totals"
"Acquiring bank" -> 3.6 : "payout advice"
3.6 -> D1 : "reconciled flag"