Agent Payment Compliance at Skyfire: PCI DSS, SOC 2, and Secure Tokenization

TL;DR

• Skyfire is PCI DSS Level 2 Service Provider compliant.
• Skyfire is working toward SOC 2 Type II completion by the end of 2026. We are not currently SOC 2 certified.
• PCI DSS credentials and SOC 2 attestations differ from product security controls. KYA provides agent identity and authorization controls. KYA is not a PCI payment token or certification.
• Our comparison evaluates Skyfire, Nevermined, Stripe, and Adyen by documented compliance credentials, tokenization approach, and best-fit use case.

What PCI DSS and SOC 2 mean for agent payments

PCI DSS governs environments that store, process, or transmit cardholder data. Payment tokenization replaces a primary account number with a substitute value. Keeping raw card numbers and security codes outside your environment can reduce PCI scope, although transaction flow and eligibility determine which Self-Assessment Questionnaire applies.

A SOC 2 examination evaluates controls against selected Trust Services Criteria. Type I assesses control design on a specified date. Type II also assesses operating effectiveness over a defined period. The auditor issues an attestation report rather than a blanket product certification.

Agent payments add a separate authorization requirement. You must verify that an identified agent may execute a specific transaction within its assigned scope. PCI DSS and SOC 2 do not establish that permission. Skyfire is PCI DSS Level 2 Service Provider compliant. We are not currently SOC 2 certified. We are working toward SOC 2 Type II and expect completion by the end of 2026.

Skyfire’s compliance posture

Skyfire is PCI DSS Level 2 Service Provider compliant. We have not completed a SOC 2 Type II attestation and are not currently SOC 2 certified. We are working toward SOC 2 Type II completion by the end of 2026. We do not claim an ISO 27001 certification or a specific PCI SAQ type.

Our product controls remain separate from these formal compliance claims. KYA provides scoped, revocable agent identity and transaction authorization. KYA is not a PCI payment token or a compliance certification. Any payment partner or subprocessor attestations apply to those providers and do not automatically extend to Skyfire.

How Know Your Agent and Agentic Wallet handle payment data

We use KYA to establish a verified, revocable agent identity and authorize a transaction within defined limits. The Agentic Wallet handles payment credential workflows and interfaces with tokenized payment data. KYA remains an identity and authorization token. It does not function as a PCI payment token, payment credential, or compliance certification.

Binding spending controls to a verified agent lets a merchant evaluate which agent initiated a purchase and whether the purchase fits its authorized task. A card number or merchant category restriction cannot provide that context alone. Agent-level controls can therefore limit unauthorized transactions and support fraud prevention alongside conventional card controls.

Skyfire is PCI DSS Level 2 Service Provider compliant. Skyfire does not currently hold a SOC 2 Type II attestation and expects to complete that work by the end of 2026. These compliance positions remain separate from KYA’s identity controls and the Agentic Wallet’s handling of payment workflows.

Why scope reduction matters more than certification badges

Architecture determines which components enter PCI DSS scope. When raw card numbers and security codes never reach agent logic, fewer services and people can access sensitive payment data. Tokenized credentials can preserve payment functionality while limiting exposure, subject to the design and controls around the token vault.

Skyfire is PCI DSS Level 2 Service Provider compliant. We are working toward SOC 2 Type II completion by the end of 2026 and are not currently SOC 2 certified. These statements do not specify an SAQ type or SOC 2 audit outcome. Buyers should review documented attestations separately from data flows and confirm where payment data is stored, decrypted, and transmitted. KYA provides agent identity and authorization controls. It is not a PCI payment token.

Skyfire vs Nevermined vs Stripe vs Adyen

We separate documented compliance credentials from product roles. Stripe and Adyen focus on payment processing, while Nevermined focuses on AI agent payment protocols. Skyfire adds agent identity and transaction authorization to existing payment rails.

Skyfire’s PCI status does not establish parity with Nevermined’s reported SOC 2 Type II, ISO 27001, or PCI SAQ-D posture. Each credential covers a defined entity, scope, and assessment period.

FAQs

• What is PCI DSS compliance? PCI DSS compliance requires entities that store, process, or transmit cardholder data to follow payment security requirements. Tokenization and avoiding raw card data can reduce assessment scope, but they do not remove every obligation.
• What is SOC 2 compliance? A SOC 2 Type I report assesses control design at a specific date, while Type II evaluates operating effectiveness over a defined period. The report covers selected trust services criteria and does not certify every product capability.
• Is Skyfire PCI DSS compliant or SOC 2 compliant? Skyfire is PCI DSS Level 2 Service Provider compliant. We are working toward SOC 2 Type II and expect completion by the end of 2026, but Skyfire is not currently SOC 2 certified.
• What is agent payment compliance and how does it differ from traditional payment compliance? Traditional payment compliance focuses on payment data and processing controls. Agent payment compliance adds verified agent identity, scoped authorization, and transaction-level spending controls.
• Is the KYA token a PCI-compliant payment token? No. KYA provides agent identity and authorization controls, while PCI payment tokenization replaces sensitive payment credentials with a substitute value.

Conclusion

Ask each vendor to provide documented attestations and map where payment data enters, travels, and remains stored. Evaluate those records separately from product controls. Then determine whether the vendor treats agent identity and transaction authorization as first-class infrastructure. We built Skyfire around that agent-native trust layer rather than adding autonomous agents to human-centric payment tooling.