@marcinw Their bank and their QSA. That's how PCI works and does hold water assuming they still respect OWASP top 10. SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique