Sigma is now PCI DSS Level 1 compliant
We’re excited to announce that Sigma is PCI DSS compliant as a Level 1 service provider. This means banks, payment companies, insurers, retailers, and any enterprise that works with payment card data can run analytics and apps on Sigma, with independent validation that their security team can review.
Coalfire, an independent Qualified Security Assessor, assessed Sigma against PCI DSS v4.0.1 and rated it compliant on every applicable requirement. The assessment covered the Sigma platform on AWS, Google Cloud, and Azure. Customers can request our Attestation of Compliance (AOC) today through the Sigma Trust Center.
What is PCI DSS compliance?
The Payment Card Industry Data Security Standard (PCI DSS) is the security standard maintained by the PCI Security Standards Council for organizations that store, process, or transmit payment card data. Level 1 is the most rigorous validation level for service providers. It requires an annual assessment by an independent Qualified Security Assessor, who documents the results in a Report on Compliance.
Sigma’s AOC covers Sigma’s environment and controls. Customers remain responsible for PCI DSS compliance in their own environments.
Use cases for PCI DSS compliant analytics in Sigma
With Sigma’s PCI DSS compliance, teams that handle payment card data can bring these workflows onto one governed platform:
- Payments and fintech: Track authorization rates, transaction volumes, and chargebacks on live warehouse data, and give merchant success teams self-service views of their accounts.
- Banks and card issuers: Monitor card portfolio performance and fraud signals, and use input tables to let analysts flag and annotate suspicious transactions.
- Insurers: Reconcile premium payments, refunds, and failed charges across products in one workbook.
- Retail and ecommerce: Match card transactions to orders and returns, and route disputed charges to the right team for review.
What to look for in a PCI DSS compliant analytics platform
If your team is evaluating analytics platforms for payment card data, look for these five capabilities. Sigma provides all of them:
- Independent validation: A current AOC from a Qualified Security Assessor, which your security team can review during vendor assessment
- Data that stays in your warehouse: Sigma queries your cloud data warehouse live, so there are no extracts to secure
- Fine-grained access controls: Row-level security, column-level security, and workspace permissions apply to every viewer
- Full audit trail: Audit logs record who accessed and changed each workbook
- A broader security program: PCI DSS joins the independent audits Sigma already maintains, including SOC 1, SOC 2, and ISO 27001
Why Sigma invested in PCI DSS compliance
Enterprises are moving their most sensitive workloads, including payment card data, into the cloud data warehouse. The analytics, apps, and agent platform that sits on top of that data should meet the same bar. We pursued PCI DSS Level 1 compliance so financial services teams can build on Sigma without waiting for security exceptions, and so their reviewers can verify our controls instead of taking our word for them.
Request Sigma’s PCI DSS Attestation of Compliance
Request our Attestation of Compliance through the Sigma Trust Center to support your next security review.
New to Sigma? Request a demo to see how payment card workflows come together on one governed platform, with no extracts to secure.
Frequently asked questions
Is Sigma PCI DSS compliant?
Yes. Sigma is PCI DSS v4.0.1 compliant as a Level 1 service provider, as assessed by Coalfire. Our AOC was signed on October 14, 2026.
Does Sigma’s PCI DSS compliance make my organization compliant?
No. Sigma’s AOC covers Sigma’s environment and controls. Customers remain responsible for PCI DSS compliance in their own environments.
Which clouds does Sigma’s PCI DSS assessment cover?
The assessment covered the Sigma platform on AWS, Google Cloud, and Azure.
What other security audits does Sigma maintain?
Sigma is independently audited for SOC 1, SOC 2, and ISO 27001.
How do I get Sigma’s AOC?
Request it through the Sigma Trust Center.
