ScopeKit: Automated Exposure Measurement and Quantified PCI DSS Scope Reduction in Super App Microservice Architectures

The rapid growth of super applications built on microservice architectures has significantly increased the number of internal access points to cardholder data. As services interact through distributed APIs, the visibility and control of sensitive payment information become more complex. Although the Payment Card Industry Data Security Standard (PCI DSS) provides regulatory requirements, organizations often lack measurable insight into which internal microservices still access raw Primary Account Number (PAN) data after implementing cryptographic controls. This paper presents ScopeKit, an automated exposure-measurement framework designed to identify, classify, and quantify cardholder data exposure within super app ecosystems. ScopeKit analyzes microservice interactions, detects raw PAN visibility, classifies exposure per transaction, and computes measurable scope reduction after tokenization and encryption. A working prototype was constructed using a modular microservice architecture consisting of an orchestrator service, tokenization service, encryption service, and evidence-logging component; tokenization and encryption are implemented as lightweight, in-process operations expected to add minimal latency per transaction, though formal performance benchmarking was outside the scope of this study. Experimental results demonstrated that 70–72% of PANs were successfully protected through early tokenization and service isolation, reducing in-scope components from eight to two. ScopeKit successfully identified specific microservices contributing to residual PAN exposure and provided measurable evidence of compliance improvement. The findings indicate that automated exposure measurement strengthens PCI DSS compliance by transforming scope determination from assumption-based evaluation to evidence-driven quantification.