Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?

  • it depends on your scope - I think you need to add some details ...
    – schroeder
    Oct 25, 2016 at 19:39
  • 1
    Use GitHub for what? public or private repository?
    – crovers
    Oct 25, 2016 at 19:41
  • @schroeder Payment system aggregator
    – iwex
    Oct 25, 2016 at 20:05
  • @crovers Of course private :)
    – iwex
    Oct 25, 2016 at 20:06
  • This question & its answers are outdated - they were true in the 3.x era of the PCI DSS standard, but the requirements changed with 4.0, the question relevant to 4.0 version of the standard (and hopefully 4.x) is here security.stackexchange.com/questions/270951/…
    – bbozo
    Jun 28, 2023 at 12:54

1 Answer 1


Note : not a QSA, but I do have some PCI experience.

There is nothing in PCI about storage of source code [mod note: this was true pre-version 4.0]. There are requirements about change management, which github would help with, but nothing about where source code should be or any requirements to keep source code private (it allows use of open source, after all). Given a private repo and assuming you do not store authentication information (keys, appids, passwords, api keys, certificates), PCI governed data or PII in GitHub repositories (which you shouldn't be doing anyways), you are probably fine using GitHub. Talk to your QSA if you want to be sure.

  • 16
    This is all correct - I'm a QSA. Just need to sure there's separation of duties between dev/test and production environments and people responsible for each. i.e. don't allow an admin access to and ability to change source code and later deploy to production environments.
    – AndyMac
    Oct 25, 2016 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .