Survive the
Marketplace Security Audit

Probably not the full SAQ-D, but you almost always inherit something. If your checkout iframes or redirects to a PCI-compliant payment processor and your servers never touch a primary account number, SAQ-A applies — fewer than two dozen controls, but you still have to attest annually and you still have to control the iframe origin, the JavaScript on the checkout page (Magecart and form-jacking are the dominant client-side card-skimming patterns), and the redirect URL. If you use a hosted payment page but render the card form in your own DOM through a tokenisation SDK, SAQ-A-EP applies and the requirement set roughly triples — including PCI DSS v4.0's new client-side script integrity controls under requirement 6.4.3 and 11.6.1, mandatory from 31 March 2025. If you ever store, process or transmit a primary account number on your infrastructure (subscription rebilling on file, B2B invoicing with stored cards, in-house point-of-sale) you are in SAQ-D territory. AxVeil scopes the SAQ category up front and tests against the actual control set, not a generic checklist.

The Digital Personal Data Protection Act 2023 — operative through the 2025 DPDP Rules — makes every D2C brand processing personal data of Indian customers a Data Fiduciary. Obligations: lawful processing with explicit consent, purpose limitation, data minimisation, accuracy, retention discipline, breach notification to the Data Protection Board of India and to affected Data Principals, and a published grievance officer. Penalties run up to INR 250 crore per breach. D2C brands sit on a particularly rich personal-data set — name, address, phone, email, purchase history, behavioural analytics, often payment-card tokens, sometimes Aadhaar for KYC-style flows. We map the data inventory, the lawful basis per processing purpose, the consent architecture (including the dark-pattern controls under the Consumer Protection Act 2019 dark-pattern guidelines), retention timelines and the breach-notification runbook. No CERT-In empanelment required for DPDP advisory; AxVeil contracts directly.

Flipkart's third-party seller security review covers data-handling, network controls, identity and access management, vulnerability management cadence (annual VAPT minimum, retest evidence on critical findings), encryption, audit logging and incident response. Amazon's third-party developer / vendor reviews are similar but emphasise Personally Identifiable Information protection and the AWS shared-responsibility model where the vendor builds on AWS. Razorpay's vendor review for high-volume merchants and platform partners overlaps both, plus a deeper look at fraud, refund-abuse and chargeback controls. The artefact each ask for is broadly the same: a recent independent VAPT report (typically less than 12 months old), evidence of remediation on Critical and High findings, the encryption and key-management architecture, the access-control model, the breach-notification policy and a security questionnaire response. AxVeil produces all of those in a single engagement cycle.

These sit between application security and business-logic abuse — exactly the bug class that scanner-only testing misses. We test the actual business flows: registration with disposable emails, OTP enumeration, coupon-stacking and referral-self-abuse, gift-card double-spend, address-book pollution to bypass first-order discounts, refund-loop manipulation through partial-cancel and split-shipment, bot-driven scraping of price and inventory, credential-stuffing against logged-in flows, and account takeover via password-reset and phone-binding bypass. The OWASP Automated Threats catalogue (OAT-001 to OAT-021) is the structural reference. Findings come with reproducible PoCs and recommendations on Bot Manager configuration, rate-limit redesign and risk-engine signal additions — not just "add CAPTCHA".

Yes. Headless-commerce stacks (Commercetools, Saleor, Medusa, custom Spree or Sylius forks) are tested via OWASP API Top 10 across the storefront-to-platform-to-PSP API surface. The presentation layer — Next.js / Remix / Astro on Vercel, Netlify or self-hosted edge — gets its own scope: middleware authorisation, edge-function trigger abuse, ISR cache poisoning, server-action exploitation, third-party script integrity (the Magecart vector). Microservices behind the storefront are covered as authenticated REST / GraphQL / gRPC tests with cross-service trust-boundary mapping. CDN and WAF (Cloudflare, Akamai, AWS CloudFront + WAF, Imperva) get a configuration review against vendor benchmarks and the OWASP CRS rule set.

Standard 4-week cycle: week 1 scoping plus reconnaissance, week 2-3 active testing (web, mobile, API, cloud), week 4 reporting plus a free retest within 30 days of remediation. PCI DSS SAQ-A or SAQ-A-EP attestation work runs in parallel — no extra cycle. If marketplace partner-program audit pressure is acute (the Flipkart / Amazon / Razorpay reviewer asked for a report by a fixed date), we compress to a 2-week cycle on the Critical Path scope (checkout, payment integration, account access, customer data API) and follow up with a complete cycle the following month.