Client
The client is a travel management company providing digital booking and travel services to business customers. To support its growth plans and platform strategy, the company needed a new travel platform that would serve as a foundation for booking, operational workflows, partner integrations, and secure payment handling.
The Challenge
The client needed a new travel platform capable of supporting business travel services while meeting strict security and compliance requirements for payment operations. The platform had to balance usability, growth capacity, and engineering flexibility with the control environment required for PCI DSS compliance.
Core challenges:
- building a cloud-based travel platform for customer-facing and operational workflows
- enabling secure payment functionality within a PCI DSS-compliant environment
- designing an architecture that could support ongoing product development and partner integrations
- embedding security controls into the platform design from day one rather than retrofitting them
- producing a platform that was auditable, supportable, and ready for formal compliance assessment
This went beyond a software delivery engagement. The work required building security, governance, and compliance into the architecture and operating model from the start.
The Solution
DataArt partnered with the client to design and build a new travel platform on AWS, treating security and compliance as core architectural requirements. The platform was developed to support business travel services while maintaining the control environment needed for PCI DSS certification.
Principles that shaped the solution
What DataArt Delivered
The engagement covered platform engineering and security architecture for the new travel environment. Key contributions included:
- design and build of an AWS-based travel platform
- security architecture aligned with PCI DSS requirements
- implementation guidance for cloud security controls and platform guardrails
- support for access control, environment segregation, logging, and monitoring
- secure delivery practices for infrastructure and application changes
- preparation of the platform for formal PCI DSS certification activities
Technologies and Practices
The platform combined cloud engineering with compliance-oriented security practices:
- AWS cloud infrastructure
- infrastructure as code
- centralized logging and monitoring
- role-based access control and least privilege
- secure environment separation
- cloud security hardening and guardrails
- compliance-aligned change control and auditability practices
Security Tooling
The platform was built around an AWS-native security architecture, complemented by selected non-AWS assurance tools integrated into the delivery lifecycle.
Edge protection for internet-facing flows:
- Amazon CloudFront, AWS WAF, and AWS Shield — protection of public application traffic against common web threats and volumetric attacks
Threat detection and posture monitoring:
- AWS Security Hub — central findings and triage layer across the environment
- Amazon GuardDuty — continuous threat detection across accounts and workloads
- Amazon Inspector — workload and vulnerability exposure visibility
- AWS Config — configuration monitoring and conformance oversight
Network and data protection:
- AWS Network Firewall — controlled egress inspection for sensitive outbound paths, with Suricata signatures for inline traffic analysis
- AWS KMS — customer-managed encryption keys
- AWS Secrets Manager — centralized secret handling
Infrastructure and delivery pipeline:
- Terragrunt and Terraform — infrastructure as code for repeatable, auditable provisioning
- SOPS — encrypted handling of secrets and RSA key material, materialized into AWS Secrets Manager during deployment
- Trivy — infrastructure-as-code and container scanning in CI/CD pipelines
- SonarQube — static application security analysis
- Jira — operational workflow for remediation tracking of security findings
The combination gave the platform AWS-native security coverage at runtime and repeatable assurance through the delivery pipeline.
Business Impact
By building a platform that addressed PCI DSS requirements as part of the solution, the client gained more than a technical refresh. The company received a digital foundation for business travel services and a platform better suited to grow, integrate, and operate in a regulated payment environment.
Benefits included:
- a travel platform designed for long-term growth
- stronger control over payment security requirements
- improved auditability and operational visibility
- more consistent and secure infrastructure and application changes
- a platform capable of supporting business needs while achieving PCI DSS compliance
The Outcome
DataArt helped the client deliver a travel platform that combined cloud capacity, operational maturity, and payment security compliance. By embedding security and PCI DSS requirements into the architecture and delivery model from the start, the project produced an auditable platform ready to support the client's ongoing business and technology evolution.
