Torus Secures PCI DSS Compliance to Bolster Security for Payment Profitability Analytics

Torus has achieved PCI DSS compliance, bringing a rigorous security framework to its transaction-level profitability analytics. For banks and acquirers, this move addresses the growing tension between the need for granular scheme fee calculations and the heavy regulatory burden of handling sensitive payment data within third-party SaaS environments, ensuring data protection matches analytical depth.

What was announced

Torus has officially implemented the Payment Card Industry Data Security Standard (PCI DSS), a global benchmark that establishes technical and operational requirements for protecting payment account data. While Torus does not operate as a third-party processor, payment gateway, or traditional payment processing company, its core functionality as an analytical SaaS platform necessitates the handling of card transaction data. This data is essential for the platform’s primary services, which include transaction-level scheme fee and interchange calculations, reconciliation, and merchant-level profitability monitoring.

The achievement of this compliance status is designed to provide banks, acquirers, and Payment Service Providers (PSPs) with additional assurance during third-party security and compliance reviews. As payment analytics become increasingly granular, the volume and sensitivity of the data required for accurate reporting have grown. By adopting the PCI DSS framework, Torus provides a pre-vetted security environment for its technology operations, reducing the friction for financial institutions when integrating transaction-level payment analytics into their existing workflows. The compliance covers the entirety of the Torus technology environment used for profitability analysis and scheme fee monitoring, ensuring that the underlying data used to calculate complex costs is protected according to internationally recognised industry standards. This move positions the firm as one of the few dedicated analytical companies in the sector to maintain such formal data protection credentials.

"Torus is not a 3-d party processor, payment processing company or payment gateway. We’re just an analytical SaaS platform that requires card transaction data for Scheme fees calculation and merchant or card product level profitability monitoring. As analytics becomes more granular, responsibility for protecting data becomes increasingly in demand among our clients. Now we are one of the few analytical companies on the market that officially complies with industry standards in terms of data protection."

Sergey Lebedev, Co-Founder and CPO, Torus

The companies involved

Torus is a fintech firm specialising in transaction-level profitability analytics and scheme fee calculations for the institutional side of the payments ecosystem. Operating as a Software-as-a-Service (SaaS) platform, the company provides transparency into the complex web of costs associated with card payments, such as interchange and scheme fees, which are often difficult for financial institutions to reconcile and forecast accurately. Its primary client base includes banks, merchant acquirers, and PSPs who require high-fidelity data to maintain margins in an increasingly competitive global market.

Unlike traditional payment processors that focus on the movement of funds, Torus occupies the analytical layer of the transaction lifecycle. The firm’s tools are designed to identify profit leakage and optimise card product performance by providing a granular view of every transaction. By focusing on the back-office operations of modern acquirers, Torus has established itself as a niche player in payment business intelligence, helping clients navigate the technical complexities of scheme fee monitoring and reconciliation without the need for internal builds of similar scale.

What FF News has reported before

FF News has tracked the development of Torus through several key industry milestones. The company was a notable participant in the FF Awards 2025, where it emerged as a winner after being named among The Finalists Announced for the 2025 FF Awards. Previously, we covered the introduction of a New Torus Tool Brings Clarity to Card Transactions Costs Forecasting, which was designed to help institutions manage the volatility of card cost structures. Furthermore, our reporting on a strategic partnership revealed how SRM and Torus Launch Solution to Recover $1 Billion in Acquirer Profit Leakage, highlighting the company’s role in identifying hidden costs for major acquirers.

What this means

This move signals a shift in the expectations placed on "pure-play" analytics providers in the fintech space. Historically, SaaS platforms that did not directly move money often avoided the most stringent PCI requirements, but as banks demand more granular data to combat margin compression, the "analytical" label no longer provides a pass on security. By securing PCI DSS compliance, Torus is putting pressure on other niche analytics firms to treat data security with the same gravity as the processors themselves. The broader industry question is whether this sets a new baseline where any tool touching transaction data, regardless of its role in the money flow, must meet full payment-grade security standards to remain viable in the enterprise market.