# How Priceline.com manages PCI compliance with GraphQL

DevFeed: [How Priceline.com manages PCI compliance with GraphQL](<https://devfeed.tech/articles/how-priceline-com-manages-pci-compliance-with-graphql-23366.md>)

Original publisher: [Read original article](<https://www.apollographql.com/blog/how-priceline-com-manages-pci-compliance-with-graphql>)

Author: Mike Byrnes

Published: 2022-09-07T11:31:00Z

Content type: article

Language: en

Sources: [Apollo Blog](<https://devfeed.tech/sources/apollo-blog.md>)

Topics: [GraphQL](<https://devfeed.tech/topics/graphql.md>), [Back end](<https://devfeed.tech/topics/backend.md>), [Development](<https://devfeed.tech/topics/development.md>), [client](<https://devfeed.tech/topics/client.md>)

Tags: [apollo](<https://devfeed.tech/tags/apollo.md>), [backend](<https://devfeed.tech/tags/backend.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [scale](<https://devfeed.tech/tags/scale.md>), [sensitive-data](<https://devfeed.tech/tags/sensitive-data.md>)

## AI overview

This article explains how Priceline addressed PCI compliance while scaling GraphQL. It describes using a supergraph to unify data and services while selectively exposing subsets of the graph to different audiences, including client applications, to avoid duplicative maintenance and limit access to sensitive data.

## Source excerpt

Let's consider the core promise of GraphQL: Get exactly what you need and nothing more with a single query. Does it sound amazing? Absolutely. But if you've ever tried to implement GraphQL for an entire engineering team, you've probably realized that it's not quite as simple as it sounds to achieve. For any dev in the organization to be able to get everything they need in a single query, everything that anyone could need has to exist in a single graph.