# How to conduct PCI scans on Vercel: A complete guide to IP safelisting **Author:** Aaron Brown --- ## Introduction [Payment Card Industry Data Security Standard](https://www.pcisecuritystandards.org/standards/pci-dss/) (PCI DSS) compliance is critical for businesses that process payments and cardholder data (i.e., credit card number, cardholder name, expiration date, PINs, etc.). A key component of PCI compliance is regular security scanning of the systems and components that store, transmit, or process cardholder data and/or sensitive authentication data. In this guide, we'll walk through guidelines for how customers can prepare their Vercel deployments to support their PCI scanning. ## Understanding the Shared Responsibility Model Before diving into the technical steps, it's important to understand the division of responsibility between Vercel and our customers. While we provide the infrastructure and security tools, customers are ultimately responsible for ensuring their application meets their compliance requirements. For an overview of PCI compliance on Vercel, refer to [PCI Compliance for eCommerce Teams](https://vercel.com/blog/pci-compliance-for-ecommerce-teams). > Customers subject to PCI DSS compliance are responsible for choosing an appropriate payment gateway provider and integrating it into their application, as stated in [Vercel's Shared Responsibility Model](https://vercel.com/docs/security/shared-responsibility). ## Step-by-step guide to safelisting IPs for PCI scanning When your application is hosted on Vercel, you'll need to temporarily safelist the IP addresses of your scanning service to allow it access to your deployment. ### 1\. Gather your scanning service information First, you'll need to contact your PCI scanning service provider to obtain: - The complete list of IP addresses they'll use to conduct the scan - The recommended duration and timing for the scan - Any specific requirements they have for accessing your application ### 2\. Access your Vercel Firewall Vercel provides a powerful [Web Application Firewall (WAF)](https://vercel.com/docs/vercel-firewall/vercel-waf) that allows you to create custom rules at the project level. 1. Log in to your [Vercel dashboard](https://vercel.com/docs/dashboard-features) 2. Select your project from the dashboard 3. Navigate to your project's **Firewall tab** ### 3\. Create a temporary safelisting rule Now, you'll [create a custom rule](https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules) to allow the scanning service access: 1. Click **Add New > Rule** 2. Name your rule something descriptive (example: `PCI Scanning Service - [Date]`), you can also add an optional description with additional information 3. In the **Configure** section, set the attribute to **IP Address** 4. Choose **Equals** to enter a single IP address, or **Is any of** to input multiple IP addresses in the same rule 5. Enter the IP address(es) in the value field. For multiple IPs, use line-separated input 6. Leave the logical operator set to **AND**, 7. Set the action to **Log** 8. Press **Save Rule** to finalize If you have existing custom rules that might interfere with scanner access, consider using the **Bypass** action instead of **Log** to ensure these IPs are allowed through the firewall. ### 4\. Test the configuration Before the official scan: 1. Ask your scanning service provider if they can perform a preliminary connection test 2. Check your logs to confirm the scanning IPs are being properly allowed through 3. Verify that the WAF custom rule is working as expected without compromising other security measures for each IP address added within the custom rules ### 5\. Post-scan review Review the scan results to ensure they meet your compliance needs: 1. Immediately disable or delete the safelisting rule 2. Confirm the flagged host or service is part of your PCI in-scope deployment 3. Analyze the vulnerabilities identified and findings related to shared infrastructure or external services not under your control (i.e., false positives) ## Tips for PCI scanning on Vercel Some suggestions that may make your PCI scanning process smooth and secure: - **Schedule during low-traffic periods**: Minimize the impact on your users by conducting scans during off-peak hours - **Implement log drains**: While we provide access to short-term runtime logs for debugging purposes, it is the customer's responsibility to set up log drains for long-term log retention, data auditing, or additional visibility into their application's performance. Learn more about [Log Drains](https://vercel.com/docs/observability/log-drains) - **Limit the scope of the scan**: Only safelist the exact IPs needed for the minimum amount of time required - **Document everything**: Maintain detailed documentation of when rules were added and removed for record-keeping purposes - **Regular scanning**: Don't wait for your quarterly compliance scan, implement regular security testing as part of your development lifecycle ## Conclusion Conducting PCI scans on your Vercel deployment helps create a straightforward process when you understand how to properly safelist scanning IPs through the Vercel WAF. Following the steps outlined in this guide will help you maintain your security posture and ensure your application supports PCI requirements. Remember that security is an ongoing process, not a one-time event. Regular scanning, prompt remediation of vulnerabilities, and staying up-to-date with Vercel's security features are all essential parts of maintaining a secure, compliant application. For information related to how Vercel supports PCI compliance, please visit [our guide](https://vercel.com/guides/is-vercel-pci-compliant). --- [View full KB sitemap](/kb/sitemap.md)