We’re happy to share that Milestone has earned PCI DSS 4.0.1 certification, confirmed through an independent assessment by Aegisra Assurance LLP. For our CMS customers, this is more than a badge. It means the platform behind your website, booking pages, and payment-connected workflows has been checked against one of the most demanding security standards in the industry.
Why this matters for CMS customers
Your CMS does far more than publish pages. It powers booking engines, guest-facing forms, and the workflows that sit right next to payment. Anywhere card data can travel, security must hold up.
That is exactly what PCI DSS is built for. It is the global standard for protecting payment card information, and it sets clear, verifiable rules for how systems that touch that data should be secured. More and more, customers and procurement teams ask for proof of it before they will trust a platform. This certification is proof, validated by an outside assessor rather than something we simply claim about ourselves.
The assessment at a glance
- Standard: PCI DSS Version 4.0.1
- Scope: SAQ-A-EP
- Assessor: Aegisra Assurance LLP (independent third party)
- Certificate ID: AEGS/SAQ/1116
What the assessment covered
The review looked at six core areas of security, all of which support the environment your CMS runs in.
Secure networks. Firewalls, segmentation, CDN protections, and hardened configurations that keep unauthorized traffic out from the network layer up.
Data protection. Strong encryption and secure handling for sensitive data, whether it is stored or moving between systems.
Vulnerability management. Regular patching, updates, and system hardening that shrink the window attackers have to work with.
Access control. Role-based permissions, authentication, and physical safeguards so only the right people reach sensitive systems.
Network monitoring. Continuous logging and testing to catch and respond to unusual activity early.
Security policy. A company-wide security program that shapes how the whole team works, from onboarding to daily practice.
What you get from it
For CMS customers, the certification gives you:
- Confidence that the platform hosting your site meets an independently verified security standard.
- Less risk around any payment-adjacent or guest data workflows connected to your CMS.
- Documentation you can hand straight to your own security and procurement reviews.
Security is ongoing, not one and done
Threats change, and so do the controls needed to stay ahead of them. This certification reflects where we stand today, and it comes with a commitment to keep investing in the monitoring, governance, and testing that keep your platform protected over time.
If you need security documentation for a vendor review, or you would like to know more about how we approach security, reach out to the Milestone team anytime.
