How UK’s Card Factory Got PCI Audit-Ready in Six Weeks, Not Six Months

47 domains. 267 third-party scripts. A clean sign-off from the auditor. When PCI DSS 4.0.1’s new payment-page requirements took effect, agentless scanning and AI-written justifications made alignment quick and easy.

The Customer: A Well-Known UK Retailer, Growing Online

Card Factory sells greeting cards, gifts and celebration essentials in more than 1,000 stores across the UK and Ireland. For years, the stores led the business and the website played a supporting role. That changed in 2025, when Card Factory bought Funky Pigeon, an online retailer of personalized cards and gifts.

Phil Shackleton, Card Factory’s GRC Lead, says Funky Pigeon’s online-first approach is giving Card Factory’s ecommerce business a fresh start. Phil has led governance, risk and compliance across the group since 2025. The deal gave him two ecommerce businesses to bring under one set of security and compliance rules.

It also gave him a head start. Funky Pigeon was already a Reflectiz customer, and Phil had his eye on the platform too.

The Challenge: A New Requirement, Not a Compliance Gap

Card Factory had a mature PCI compliance program. What changed was the standard. PCI DSS 4.0 added requirements 6.4.3 and 11.6.1, which ask merchants to show their QSA (Qualified Security Assessor, the auditor who checks PCI compliance) script-level control over payment pages.

In plain terms, you now need to list every script on your payment pages, explain why each one is there and get alerts when something changes. For Card Factory, that meant dozens of domains carrying marketing tags, analytics, payment scripts and third-party libraries. The existing controls met the previous standard. The new requirements called for a new kind of evidence.

Producing that evidence by hand means finding, listing and justifying every script, then watching each one for changes. It can be done, but it takes months that skilled people could spend on more valuable work.

The Solution: Why Reflectiz, and Why Agentless

Phil first saw Reflectiz at the InfoSec show in London and liked what he saw. With Funky Pigeon already using it, Reflectiz was a natural fit. Card Factory still ran a full evaluation before signing up.

“We did our RFP due diligence before we committed,” Phil says. After looking at other vendors, the team didn’t feel they were missing out on anything. “We felt we’d made the right choice.”

Agentless deployment was the deciding factor. Agent-based tools would have needed a big effort from the infrastructure team across every site. Reflectiz needed no agents and no code changes.

“We knew we had to be agentless. That was a massive tick in the box.”

Three things sealed the deal: agentless deployment, the fit with Funky Pigeon and a detailed conversation in London that covered all of Phil’s PCI needs.

A Product That Made Compliance “Almost Enjoyable”

Phil expected a long, hard project. Instead, the work was easy and brought real benefits.

“We found it a really intuitive, very straightforward product to use. It drove you through the process and made something that was incredibly time-consuming and frustrating to do by hand almost enjoyable. It just made sense.”

Onboarding was just as smooth.

“Michael’s fantastic, always there when you need him. The console feels uncluttered, so you can navigate easily to where you need to be. We feared in the initial setup that firewalls and other security concerns might cause data to be missed, but that proved unfounded. The collation of information was really good, and where there were initial issues, Michael worked around them proactively to get us onboarded quickly.”

The AI That Wrote the Justifications

The feature that made the biggest difference, Phil says, was Reflectiz’s AI-generated justifications. These explain what each script is and why it’s there.

“I said to my colleague at the time: if it wasn’t for the AI piece, we’d still be writing the commentary for this today.”

The platform drafted a justification for all 267 scripts. The team just had to review them.

“You’re seeing common themes and trends, you let the AI rip through it, and then you read and review what it’s produced. That was a godsend.”

One Project, Two Wins

Cataloging every script did more than meet the new PCI requirements. Card Factory’s digital team and its new ecommerce team reviewed the findings together. Along the way, they mapped the company’s websites from end to end for the first time.

“It had a twofold effect: it got us [aligned with the new requirements] very quickly, but it also gave us the insight and a way of documenting our websites that just wouldn’t have happened otherwise.”

Now the teams bringing the two businesses together have a clear list of systems and dependencies to work from.