Is Core dna PCI Compliant?
Core dna simplifies PCI compliance with integrated payment gateways for secure credit card transactions and offers integration for over 20 gateways.
Updated: July 27, 2025
Development & Tech
Core dna makes PCI compliance easy by offering integrated payment gateways that allow merchants to securely transmit credit card data via direct post API methods or with hosted payment forms provided by the payment gateway and integrated with the merchant’s checkout pages.
The Direct Post method allows for information to be sent directly to the payment gateway without sensitive data flowing through or stored on the Core dna application server. We currently have over 20 integrated payment gateways. If we do not have the one you are currently using, we are happy to integrate with it for you.
Related Questions
Core dna is framework agnostic.
An agnostic framework means you can create any design using the front-end technology and frameworks that you know and love.
We believe in being open-minded and non-discriminatory when it comes to technology choices, and we want our clients to feel empowered to use whatever works best for them and their projects, regardless of whether it's something we've already tried and failed with before!
Core dna never requires you to use specific templates or libraries. As a decoupled platform, Core dna also has server side templating that can be used to deliver projects quickly and efficiently using only HTML, CSS and Javascript. The server side frameworks supported are Twig and Smarty.
What is an agnostic framework?
An approach to software development that doesn't favor any one language or technology over another. Agnosticism is a philosophical position which states that it is not possible to know anything about God or other supernatural beings. A Software Agnostic approach would say that there is no right or wrong when it comes to the tools you use in your job as long as they get the job done.
What is Smarty?
Smarty is a template engine for PHP. More specifically, it facilitates a manageable way to separate application logic and content from its presentation. This is best described in a situation where the application programmer and the template designer play different roles, or in most cases are not the same person. It is extremely fast. It is efficient since the PHP parser does the dirty work. No template parsing overhead, only compiles once.
What is Twig?
Twig is a modern template engine for PHP. It's fast. Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. It is secure. Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a template language for applications where users may modify the template design. It is flexible. Twig is powered by a flexible lexer and parser. This allows the developer to define its own custom tags and filters, and create its own DSL.
What is a decoupled platform?
A decoupled platform is a software architecture where components are independent of each other. This allows for easier development, testing, and maintenance of the individual pieces that make up the whole product or system.
Decoupled platform advantages:
A decoupled platform will allow your software to be more easily scalable and upgradable as new technologies become available. It also means your developers won't have to worry about updating multiple parts of your application every time there's an update released; they'll just need to update one piece at a time!
GET IN TOUCH TODAY
Schedule a one-to-one consultation with your product specialist
Here’s what you can expect:
- Walkthrough: An introduction of the Core dna platform
- Analysis: Personalized recommendations based on your business needs.
- Case studies: How other businesses have used Core dna to scale more efficiently
With ERP systems, there are a number of different data points that you might be interested in passing back and forth. Here are some of the most common:
- Order data
- Shipments
- Customers
- Inventory
- Product data
- Customer groups
- Invoice data
- Transactions
If there is an API available for your ERP system, Core dna can integrate directly with your ERP using the API to call/push the data that you are looking for. We currently have API level integrations with some of the more popular systems including Microsoft Dynamics and SAP. Often times, however, you may be using a legacy system that does not have an API. We can use secure FTP or CSV files to then connect and pass data to and from Core dna.
Core dna is fully GDPR compliant. You can find our commitment here - https://www.coredna.com/gdpr
GDPR is short for the General Data Protection Regulation that went into effect on May 25, 2018. Its purpose is to support privacy as a fundamental human right and therefore give EU residents rights over how their personal data is processed or otherwise used.
In preparation for GDPR, we formed a core team of leaders from each area of Coredna.com's business, coordinated by our internal Data Protection Officer (DPO). The representatives in this group were charged with ensuring that all the requirements of GDPR were addressed across all teams. The team met once a week to discuss progress towards GDPR readiness, and has continued to do so following the May 25th 2018 deadline so we can continue to ensure our complete GDPR compliance today and in the future.
We have written extensive content on this topic, which you can find on our site: General data protection regulation, GDPR fines, and GDPR preparation.
A word of caution though: GDPR encompasses more than just system/platform compliance. There are a host of policies, procedures, and processes that must be established. The right platform can help with that - and Core dna does - but true compliance requires active participation by your team.
Schedule a one-to-one consultation with your product specialist. Here’s what you can expect:
Walkthrough: An introduction of the Core dna platform
Analysis: Personalized recommendations based on your business needs.
Case studies: How other businesses have used Core dna to scale more efficiently
Core dna is a fully managed, Zero-Plugin SaaS platform, meaning we take 100% operational responsibility for your infrastructure. Unlike a WordPress-Shopify hybrid for example, which requires a dedicated team to manage plugin conflicts, manual security patches, and server scaling, Core dna automates these tasks at the engine level.
- Automated Security & Patching: We handle all core upgrades and security patches automatically. Because our features are native rather than third-party plugins, you never have to worry about an update "breaking" your site logic.
- Native PCI Compliance: Core dna is a PCI-compliant platform. We manage the complex security standards required for global commerce, ensuring your payment environments are secure and reducing your internal compliance burden.
- Infrastructure as a Service: We handle server scaling, load balancing, and global CDN delivery. Whether you have 10 sites or 100, your infrastructure scales automatically to handle traffic surges with zero manual intervention from your DevOps team.
- Continuous Modernization: Unlike versioned software (like WordPress, Joomla and Drupal) that requires a "rebuild" every few years, Core dna is a Continuous Modernization platform. We deploy enhancements every two weeks, ensuring your enterprise stack is always up-to-date and secure.
Yes, and in practice most integrations do. A common pattern is to let a webhook notify your system the moment an event occurs — say, a new order — and then use an API call to pull the full order record or push an update back to another system. The webhook handles the real-time trigger; the API handles the on-demand data exchange.
Core dna is built for exactly this. Our platform pairs a documented REST API with a webhooks engine, so you can react to events in real time and query or sync data on your own schedule from the same integration.
Reach for a webhook when you need to act the instant something happens and don't want to keep asking — an order placed, a payment processed, inventory changed. The event pushes the data to you automatically, which is lighter on resources than repeatedly polling an API.
Reach for an API when your system needs to control the timing — pulling a product catalog on a schedule, syncing customer records, or running a query on demand. Many teams use both, and Core dna's content and commerce platform supports each pattern across its native integrations.
Yes. Core dna provides a documented REST API for integrating our content and commerce platform with your existing software, alongside a webhooks engine for real-time, event-driven updates.
On top of that, Core dna offers hundreds of prebuilt native integrations — SAP, Salesforce, Oracle, Stripe, HubSpot and more — so you can connect legacy systems, run file transfers, or build against the latest API technology. If a system has an API, Core dna can integrate with it.
Core dna seamlessly connects with your existing tools to create a unified ecosystem—whether it’s HR systems, CRMs, or third-party platforms, our API-first architecture and pre-built integrations ensure smooth data flow. This means your team can work more efficiently without the hassle of manual processes or disjointed systems."
Yes. Forms are a native Core dna application, so a form you build in the admin can hand its submissions to another system the moment they are captured — no CSV exports, no copy-paste between tools.
There are three ways to make the connection, depending on what your CRM supports:
- Pre-built integrations. Core dna ships direct integrations with common CRMs, ERPs, payment processors and identity providers. Where one exists, mapping a form field to a CRM field is configuration rather than development.
- The open API. Our API-first architecture lets your CRM pull submissions, or lets Core dna push them, using the fields you choose.
- The Hooks orchestration engine. Hooks covers everything without a native connector: trigger on submission, transform the payload, route it to one destination or several, and retry on failure.
A single form can feed more than one destination at once — for example pushing a lead into your CRM while notifying a sales channel and writing the record back into a customer portal. If your CRM is a legacy system with no API at all, we can still exchange data over secure FTP or scheduled CSV transfer.
A 7-minute overview on deploying to different environments on Core dna.
GET IN TOUCH TODAY
Schedule a one-to-one consultation with your product specialist
Here’s what you can expect:
- Walkthrough: An introduction of the Core dna platform
- Analysis: Personalized recommendations based on your business needs.
- Case studies: How other businesses have used Core dna to scale more efficiently
Video transcription: How to Deploy to Different Environments on Core dna
So in this video we're going to see how development is done on coordinate by front end teams. The coordinate platform is completely decoupled from the UX. So front end development teams can actually build complex front end users lined interactions for customers while being able to use standardized language to talk to Core dna.
I've just logged into an IDE, just a normal IDE. And what you'll notice about this on the left hand side is a structure of how this particular site, this demonstration site that we're working from, is structured.
You'll see that it has assets that are there. It'll have the modules which are the Core dna applications that are being used. It will have a templates directory where we have the base templates. It'll have a template directory which is where the compile templates go.
It may have a web images directory. You'll see the node modules has been installed as we'll be using Gulp in this particular project to build out our JavaScript and we'll have our source JavaScript and then finally we'll have a distribution JavaScript.
So as a developer you can establish your own environment the way you'd like to work on it. And as long as you stay within the standards of the modules directory, the web images and the template directory, then your site should function normally.
In addition, what you'll also notice down the righthand side here is that this site is connected to the Git repo. And it's a very straightforward approach to once you have either use ours or use your own repo, you're able to look at all the remote branches, all the different branches that have been developed for this website, and you're able to create new branches and check out branches.
So Core dna has complete integration into Git and offers you the ability to push your changes to a QA environment for testing and then to merge those changes into production. But before you kind of get into the QA environments and pushing to the repos and all that, most developers just want to be able to quickly develop.
And what Core dna has is a SFTP environment development environment that we've established. And it's very simple to configure. You go down to deployment, you can go down to configure and you can establish your connection to the host.
You can set up your mappings for how you want the site to map, and you can then establish it as a connection. So really, to deploy to those environments is very simple. You make a change to a site. So I'm going to go into a site here, and I'm going to update this tag here to say Sam was here, and all we do is save.
And you'll notice that the changes are sent instantaneously to our dev server. And when we look at the environment, we can see here that if we press refresh on the dev environment, all of a sudden now Sam was here on the dev environment, and if we want to remove it, it's a simple case of just removing the content.
And it will automatically transfer and then just press refresh and the change will be gone. So in this way, developers can quickly create UX's and themes and solutions for their customers in a very localized approach.
And then when they're ready, they can then push those changes into production. And so we have here the production version of the Media Center and you'll notice that it has a number of similar directories.
You'll see here is the source files we can return and then we have the all JS files. We then have the modules that are being used and they generally mimic the modules that are here. Now, once a developer is ready to push their changes into testing, they're able to then come to their IDE and do a commit and a push.
And what happens then is through the use of webhooks, Core dna is able to then apply those changes to the production environment. If we take a longer look at the repo itself, we're able to see that this keeps all the commits that you do.
And so this hasn't been updated in a number of months, but we can actually go into those commits and have a look at what were the changes, what exactly changed, and if we want to, we can actually back those changes out.
In addition, we can see all the branches that are currently available and at what progress these branches are in terms of the master branch. So we can actually switch between them. We can also see the pull request that have occurred and so on.
So all the sites that you work on actually can be found here and you're able to navigate between them. You could do a you can go into a site, clone the site, pull it down, it then becomes available in your IDE, and you can begin work either by doing a deploy to your deploy environment or by doing a commit and push for small changes straight through to your Bitbucket account. The IDE itself supports the inclusion of Git. It's very simple to set up and also includes the ability to deploy. So as long as your server or your ID can support it, you can then use Core dna to develop out of the box.
Yes. Core dna has direct integrations with common ERPs (SAP, NetSuite, Microsoft Dynamics 365), PIMs, CRMs, payment processors, scheduling and booking systems, and identity providers, plus an open API and the Hooks orchestration engine for everything else. ERP sync is real-time and bidirectional. For multi-brand operators, the ERP integration is configured once and runs across every brand.
The same applies to operational systems. We pull schedules from your booking system so customers see real-time availability per location, push leads into your CRM, and sync customer records into your member portal.
Yes. Core dna writes to SAP through custom endpoints. It looks up or creates the customer, builds the sales order with the right routing, reserves inventory, and hands off to logistics. For V-ZUG, an order that took around 15 minutes to raise by hand now takes a couple of minutes.
Core dna integrates with SAP, Oracle NetSuite, Microsoft Dynamics 365, Infor, Epicor, and Sage, syncing inventory, pricing, product data, and orders in both directions. Core dna's integrations are part of the platform. Your storefront always shows accurate stock and pricing without manual updates.
No — though they're closely related. An API (application programming interface) is a two-way channel: your system sends a request and gets a response, so you control when data moves. A webhook is one-way and event-driven: the moment something happens — an order is placed, a payment clears — the source app automatically pushes the data to a URL you specify, with no request needed.
The simplest way to think about it: with an API you ask for data; with a webhook the data comes to you. Core dna provides both a REST API and a webhooks engine, so you can use whichever fits the job.
Core dna is designed on open, component-based architecture to be a flexible environment that can be easily managed. The architecture supports a range of operations and has been tested on both Unix and Windows based platforms. This helps to reduce problems that can arise from different operating systems and allows flexibility during deployment. The presentation layer supports an interaction with the business logic through the services layer. It allows the flexibility for each of our clients to control the look and feel of their website as well as the functional modules they wish to deliver.
The technology is built on the scaleable technology stack. Linux base operating system, Apache HTTPd web server, MariaDB database layer and PHP development language. The front end stack is agnostic and we have developed solutions using a variety of front end frameworks including Bootstrap, Foundation, UI kit, AngularJS, React.
We prioritize your organization’s security with a robust, multi-layered approach—role-based permissions allow you to control access at every level, while our cloud infrastructure adheres to enterprise-grade standards like GDPR compliance. Our dedicated team also provides 24/7 monitoring to keep your data safe and secure, giving you peace of mind.
They fail differently, and the difference is plugins.
WordPress powers a large share of the web, which makes it a standing target. But most WordPress incidents are not flaws in WordPress core — they come from the third-party plugins bolted on to reach enterprise functionality. Each plugin is a separate codebase with its own maintainer, its own patch cadence, and its own odds of being abandoned. Keeping that stack patched, compatible, and trustworthy is ongoing work, and it falls to you.
Core dna is a zero-plugin platform. The functionality WordPress reaches through add-ons — commerce, forms, permissions, workflow — is native here, which changes the security position in three ways:
- One accountable codebase. There is no third-party plugin surface to audit, and no update that breaks your site logic because two add-ons disagree with each other.
- Patching is ours, and automatic. Core upgrades and security patches are applied at the engine level as part of the subscription. There is no instance sitting unpatched because nobody scheduled the work.
- Protection is on by default. Every site runs behind a web application firewall with DDoS, XSS, and malicious-bot protection, plus monitoring and backups — not as a paid add-on.
Core dna is also PCI compliant at the platform level, and SOC 2 Type II and PCI DSS attestations are available. More on how we approach this is in website security.
The honest caveat: a well-run WordPress site with a disciplined team, a minimal plugin set, and real patching routine can be perfectly secure. The argument for Core dna is that it does not depend on that discipline holding for years.
A 10-minute overview of development on Core dna. Learn about Smarty, GIT, our deployment environment, and more!
More reading
Related posts