Keep the tills open from Black Friday to Boxing Day.

A first-class feature. You declare freeze windows (e.g. 15 Nov through 5 Jan) per brand or per environment. During freeze, TigerTrust extends any certificate that would expire inside the window using a controlled bridge cert, defers non-critical rotations, and elevates on-call for the ones that must proceed. No renewal accidentally lands mid-Black Friday.

Continuous subdomain enumeration surfaces every payment-related endpoint (including the ones marketing spun up without telling security). Requirement 4 evidence covers TLS strength and rotation cadence. Requirement 6 evidence covers change management and vulnerability posture. Quarterly ASV scan support is built in — the scan finds nothing that TigerTrust did not already flag.

Each brand or franchisee gets its own tenant with delegated admin. Parent brand sets guardrail policy (approved algorithms, validity ceilings, brand-approved CAs); franchisees operate their own certs within those guardrails. Audit rolls up to the portfolio owner while day-to-day operations stay local. This matches how most multi-brand retailers actually run.

Yes. Native integrations for Cloudflare, Akamai, and Fastly manage cert lifecycle at the CDN edge. When TigerTrust renews, the CDN's SNI cert updates atomically with pre-flight validation on a canary POP first. If the canary fails, the rollback is instant and traffic never sees a broken TLS handshake.

TigerTrust supports the certificate flows expected by EMV terminal certification and Point-to-Point Encryption solution scope. Payment terminal identities are provisioned per PCI PIN Transaction Security requirements. For solution providers under P2PE, the key custody and audit trail satisfies P2PE evaluation without additional work.