A firewall built for PCI DSS — checked on every rule change.

Enforza is a firewall that helps you meet the firewall-rule requirements of PCI DSS — primarily Requirement 1 (install and maintain network security controls). It ships a bundled PCI DSS v4 pack and checks every policy change against it, advising or blocking rules that would break a control. It does not make your whole organisation PCI compliant: PCI DSS covers far more than network controls (encryption, key management, logging, access management, physical security), and compliance is assessed by a QSA or via SAQ. Enforza covers the network-security-control slice and gives you the evidence for it.

PCI DSS Requirement 1 (v4: network security controls) requires that you restrict inbound and outbound traffic to and from the cardholder-data environment to only what is necessary, deny everything else by default, prohibit direct public access to CDE systems, control connections between trusted and untrusted networks, and formally approve and document every ruleset change. Enforza's policies are default-deny with explicit, scoped allows, and its guardrails check each of those obligations against the PCI DSS v4 pack on every change.

You attach the bundled PCI DSS v4 pack to the policy governing your CDE. On every policy change — whether published from a GitHub pipeline or the console — Enforza checks the rules against the pack's Requirement 1 controls: default-deny sections, no unscoped public inbound, scoped (FQDN/SNI) egress, and controlled trust-zone connections. Violations are advised or, in enforce mode, blocked before the rule reaches a firewall, and each result is recorded as an audit event.

No — you define which networks are in scope. Enforza enforces the rules you write with a default-deny posture and checks them against the PCI DSS pack, but segmentation scoping is your design decision. What Enforza gives you is confidence that the rules around the CDE stay default-deny and explicitly scoped, and that any change loosening them is caught before it ships.

Yes. Every compliance check is recorded — the controls evaluated, what passed, what was advised, and any enforce block that rejected a change before it reached a firewall. That gives you a defensible record of how firewall-ruleset changes are controlled and approved, which is exactly what Requirement 1.2.1 asks for. Enforza evidences the network-control changes; it is not a substitute for your overall PCI programme or your QSA assessment.

Enforza is a flat per-firewall licence — £179/month per firewall, dropping to £149 from your sixth — plus the VM you run it on, with no per-GB data-processing charge. Against a cloud-native firewall stacked with a NAT gateway (two per-hour fees often duplicated per Availability Zone, plus two per-GB meters), the flat line is typically 60–80% cheaper at modest egress. The PCI DSS pack and advise-or-enforce guardrails are part of the platform, not a paid add-on.