PCI DSS Compliance Scanner — User Manual

A practical guide to what the UbiComply PCI DSS Compliance Scanner does, who uses it, and how each type of user gets their work done. It covers the web application, the scanning engine, the audit workflow, and the VS Code extension.

• Standard covered: PCI DSS v4.0.1 — 63 controls (canonical ids PCI-x.y), backed by a 532-item requirement checklist.
• Where it runs: a web app (dashboard, scanning, assessment, audit workflow) plus an optional VS Code extension for developers.

What the system is for

The platform scans a software codebase for PCI DSS compliance and turns the raw results into an auditable record: findings, requirement coverage, curated remediation, uploaded evidence, auditor sign-off, and finally a Report on Compliance (ROC) / Attestation of Compliance (AOC).

Two audiences share one system:

• Builders (developers, org members) run scans and fix findings.
• Assessors (auditors, senior officials) review the results, attach evidence, set a disposition per control, and sign off compliance cycles.

Think of it as: scan → understand → remediate → evidence → attest.

Roles at a glance

The system is role-based. Your role decides which menu items you see and what you can do, and a user can hold more than one role.

• User — scans their own code, views results and uploads evidence.
• Org Admin — everything a user can, plus managing organisation members and auditors.
• Org Member — runs scans whose results are visible to the whole organisation.
• Auditor — independent, read-only reviewer who sets dispositions, attaches evidence and signs compliance cycles.
• Senior Official — approves assessments and provides senior sign-off.
• Platform Admin — operates the whole platform and manages all users.

What this manual covers

1. What the system is for
2. Core concepts and glossary
3. Roles at a glance
4. Getting started
5. Running a scan
6. Reading your results
7. The assessment (AI scans, in depth)
8. Scope and the cardholder data environment (CDE)
9. The audit workflow
10. Organisation management for org admins
11. Platform administration
12. Profile and account
13. VS Code extension for developers
14. What to expect — service behaviour and limits
15. Security and privacy
16. Troubleshooting and FAQ
17. Quick reference — where things live

Loading the full manual…