Simplify PCI DSS Network Segmentation
Loxada makes it straightforward to maintain PCI DSS network segmentation outside a controlled office, for remote and hybrid staff and across retail estates, without complex setups.
The Problem
Loxada provides device-enforced network separation that supports PCI DSS segmentation, whether the device is in a home office or on a shop floor.
Each Loxada secure router creates a hardened work network regardless of the local infrastructure it connects to, and routes that traffic through Loxada’s secure connectivity layer, an encrypted connection from the device out to the internet. Devices on the Loxada network are isolated from the surrounding environment, keeping them separate from unknown and potentially vulnerable systems.
- Hardware-level segmentation. Devices and payment systems accessing cardholder data are separated from other devices on the local network.
- Encrypted connectivity with no user configuration. Traffic is routed through Loxada’s secure connectivity layer, with no reliance on the local network being sound.
- Central control and secure-state behavior. Devices cannot be modified locally and return to a secure default if reset. Access is controlled centrally through subscription and cannot be bypassed by the user.
- Blocks known malicious domains. Requests to domains on Loxada’s aggregated blocklist are dropped before they resolve.
- Consistent policy. Whether staff are at home, traveling, at a secondary site or behind a till, network access stays predictable and auditable.
This supports the intent of PCI DSS segmentation without the cost or complexity of managing firewalls, VLANs or agent-based software across networks you do not control.
Loxada’s Solution
Loxada provides device-enforced network separation that supports PCI DSS segmentation, whether the device is in a home office or on a shop floor.
Each Loxada secure router creates a hardened work network regardless of the local infrastructure it connects to, and routes that traffic through Loxada’s secure connectivity layer, an encrypted connection from the device out to the internet. Devices on the Loxada network are isolated from the surrounding environment, keeping them separate from unknown and potentially vulnerable systems.
- Hardware-level segmentation. Devices and payment systems accessing cardholder data are separated from other devices on the local network.
- Encrypted connectivity with no user configuration. Traffic is routed through Loxada’s secure connectivity layer, with no reliance on the local network being sound.
- Central control and secure-state behaviour. Devices cannot be modified locally and return to a secure default if reset. Access is controlled centrally through subscription and cannot be bypassed by the user.
- Blocks known malicious domains. Requests to domains on Loxada’s aggregated blocklist are dropped before they resolve.
- Consistent policy. Whether staff are at home, travelling, at a secondary site or behind a till, network access stays predictable and auditable.
This supports the intent of PCI DSS segmentation without the cost or complexity of managing firewalls, VLANs or agent-based software across networks you do not control.
Benefits and Use Cases
-
- Customer service agents handling card data remotely, keeping CDE boundaries intact on unmanaged networks.
- Back-office finance teams in hybrid setups, with consistent protection in the office or at home.
- Retail operations and store estates, isolating payment systems on shared or outsourced infrastructure.
- Contact centers using BYOD or temporary staff, providing a consistent access layer without reconfiguring personal networks.
-
By creating a consistent, isolated environment for handling payment data, Loxada helps organizations avoid unnecessarily expanding their CDE, saving time, cost and audit scope.
Why It Matters for PCI DSS 4.0.1
The current standard places greater emphasis on flexibility and customized approaches, alongside clear expectations around secure access and segmentation. Assessors may ask for network diagrams, documentation showing traffic is isolated, and evidence of reduced scope based on segmentation controls.
Loxada gives you a repeatable control you can document and demonstrate to assessors: a physical, centrally managed system that reduces reliance on variable per-location router configurations and software agents, keeps non-CDE systems out of scope, and behaves consistently regardless of where the user or the till is.
Deployment is fully auditable, with monthly security reports and device-status visibility, which is the form of evidence an assessor is likely to ask for.
Whether a given segmentation approach reduces your assessed scope is ultimately your QSA’s determination. What Loxada provides is a consistent, documentable control to bring to that conversation.