# What is PCI compliance?

URL: https://www.paydude.io/resources/what-is-pci-compliance
Type: Guide
Published: 2026-09-02 · Updated: 2026-09-02
Summary: PCI DSS governs how card data is handled. Which SAQ applies to you, and why the right integration reduces 300+ requirements to about 20.

**PCI DSS — the Payment Card Industry Data Security Standard — is the set of security requirements governing how card data is stored, processed and transmitted.** It applies to every business accepting cards. How much of it applies to you depends almost entirely on your integration.

## Summary

Everyone who takes cards is in scope; the question is how much. Keeping card numbers off your servers cuts 300+ requirements to about 20. SAQ A is the short path, and the right integration is what earns it. Using a modern provider simplifies compliance but does not remove the obligation.

## Scope is the whole game

PCI scope is determined by whether card data touches your systems. If it never does, the overwhelming majority of the standard becomes irrelevant to you — and the difference in effort is enormous.

**Self-assessment questionnaires by integration type**

| SAQ | Applies when | Roughly |
| --- | --- | --- |
| A | Card data fully outsourced — hosted fields or redirect | ~20 questions |
| A-EP | Your page controls the payment form but does not receive card data | ~140 questions |
| D | Card data touches your servers | 300+ questions |

The jump from SAQ A to SAQ D is not incremental — it means network segmentation, quarterly scanning, penetration testing, formal logging and access control, and often an external auditor. It is a programme of work, not a form.

> **The integration decision is the compliance decision:** Choosing hosted fields or a redirect, so raw card numbers never reach your server, is what buys you SAQ A. That single architectural choice saves more compliance effort than anything you can do afterwards.

## What can silently expand your scope

- **Taking card details over the phone** and typing them into your own system.
- **Accepting card numbers by email or chat** — even to delete them later.
- **Logging request bodies** that happen to contain card data.
- **Building your own payment form** that posts card numbers to your backend.
- **Storing a card number anywhere**, including in a support ticket or a spreadsheet.

Each of these can move you from SAQ A to SAQ D without anyone deciding to. The mitigation is [tokenisation](https://www.paydude.io/resources/what-is-tokenization): let the provider hold the card and give you a reference.

## What compliance actually involves

For most SaaS businesses on SAQ A it is an annual self-assessment questionnaire, an attestation of compliance, and keeping the architectural choices that earned the reduced scope. Larger merchants — above roughly six million transactions a year — face a full audit by a qualified assessor instead.

**Card data never touches your servers** Hosted fields and tokenisation, so SAQ A stays within reach. — [See how it works](https://www.paydude.io/pricing)

## Frequently asked questions

### Do I need to be PCI compliant?

Yes — every business that accepts card payments does. What varies enormously is how much of the standard applies. Using a hosted field or redirect that keeps card numbers off your servers reduces the requirements from over 300 to roughly 20.

### What is SAQ A?

The shortest self-assessment questionnaire, for merchants who fully outsource card handling so that card data never touches their systems. If you use a provider's hosted fields or redirect, this is usually the one you qualify for, and it is the reason that integration choice matters so much.

### What happens if I am not compliant?

Monthly non-compliance fees are common. In the event of a breach, fines can reach six figures, and you may be required to fund forensic investigation and card reissuance. In serious cases the acquirer withdraws card acceptance.

### Does using Stripe or Paydude make me PCI compliant automatically?

It makes compliance dramatically simpler but does not remove the obligation. You still complete the appropriate SAQ and keep the scope reduction intact — which means not, for example, logging card numbers or accepting them over the phone into your own systems.