About the client
The client is an international passenger airline operating across multiple regions. The company runs a multi-channel retail and booking environment and is undertaking improvements to its commerce capabilities. As part of this work, the airline sought to strengthen governance, compliance, and operational controls for payment processing across customer-facing touchpoints, including online and assisted channels.
Challenge
As the airline expanded its digital booking capabilities, payment processing became central to revenue, customer experience, and compliance posture. The existing setup required a more structured platform approach to payment orchestration, token handling, gateway integration, and security governance.
The new solution had to support several priorities at once:
- reliable integration between booking flows and payment services
- reduced payment-related operational risk
- PCI DSS-aligned architecture decisions and evidence collection
- tighter control over cardholder data exposure and system scope
- a foundation for secure future integrations with the new internet booking engine and related services
This went beyond payment feature delivery. It required designing a platform with security, compliance, observability, and change control built into the operating model from day one.
Solution
DataArt worked with the client to define and shape the Payment Operations Platform (POP) as a dedicated payment layer for airline commerce services. The platform centralizes and standardizes payment operations while reducing direct exposure of sensitive card data across connected systems.
The design was based on several architectural principles.
What DataArt Delivered
The engagement covered both platform-level security architecture and delivery guidance for implementation teams. Key contributions included:
- security architecture direction for the Payment Operations Platform
- PCI DSS-oriented scoping and control analysis
- tokenization and cardholder data exposure reduction strategy
- threat modeling of payment flows and platform components
- security non-functional requirements for connected services
- guidance for secure software delivery and pipeline security controls
- documentation inputs for guardrails, risk treatment, and operational procedures
- alignment of platform decisions with the new booking ecosystem
Technologies and Practices
The solution combined payment platform patterns, cloud services, and secure delivery practices:
- AWS-based cloud infrastructure
- infrastructure as code and controlled release pipelines
- centralized logging and security event monitoring
- encryption and managed key controls
- role-based access control and service authentication
- threat modeling and security architecture review
- vulnerability scanning and CI/CD security checks
- PCI DSS control mapping and evidence preparation
Security Tooling
The platform combined a predominantly AWS-native security control plane with selected non-AWS assurance tooling integrated into the delivery lifecycle.
Together, these controls provided the client with an AWS-centered security model, supported by repeatable CI/CD assurance and a structured remediation workflow.
Business Impact
The POP initiative gave the airline a stronger foundation for secure payment growth. Instead of treating payments as a set of isolated integrations, the carrier moved toward a dedicated platform model that improves consistency, control, and audit readiness.
Expected and delivered benefits included:
- lower payment security risk through tighter segmentation and tokenization
- improved readiness for PCI DSS-aligned control implementation
- better visibility into payment-related events and operational issues
- more consistent integration patterns for current and future payment services
- a clearer path for scaling booking and payment capabilities without expanding sensitive data exposure
Outcome
By establishing the Payment Operations Platform as a dedicated, security-conscious payment layer, the airline created a more resilient foundation for digital commerce. The initiative helped align payment modernization with compliance obligations, engineering delivery, and long-term platform growth.
Rather than adding more point integrations, the carrier moved toward a model in which payment services can be governed, monitored, and evolved predictably, which carries weight for any airline running customer-facing digital channels at scale.
