PCI DSS — the Payment Card Industry Data Security Standard — is the set of security requirements governing how card data is stored, processed and transmitted. It applies to every business accepting cards. How much of it applies to you depends almost entirely on your integration.
Scope is the whole game
PCI scope is determined by whether card data touches your systems. If it never does, the overwhelming majority of the standard becomes irrelevant to you — and the difference in effort is enormous.
| SAQ | Applies when | Roughly |
|---|---|---|
| A | Card data fully outsourced — hosted fields or redirect | ~20 questions |
| A-EP | Your page controls the payment form but does not receive card data | ~140 questions |
| D | Card data touches your servers | 300+ questions |
The jump from SAQ A to SAQ D is not incremental — it means network segmentation, quarterly scanning, penetration testing, formal logging and access control, and often an external auditor. It is a programme of work, not a form.
What can silently expand your scope
- Taking card details over the phone and typing them into your own system.
- Accepting card numbers by email or chat — even to delete them later.
- Logging request bodies that happen to contain card data.
- Building your own payment form that posts card numbers to your backend.
- Storing a card number anywhere, including in a support ticket or a spreadsheet.
Each of these can move you from SAQ A to SAQ D without anyone deciding to. The mitigation is tokenisation: let the provider hold the card and give you a reference.
What compliance actually involves
For most SaaS businesses on SAQ A it is an annual self-assessment questionnaire, an attestation of compliance, and keeping the architectural choices that earned the reduced scope. Larger merchants — above roughly six million transactions a year — face a full audit by a qualified assessor instead.
GOOD QUESTIONS
Frequently asked
Do I need to be PCI compliant?+
Yes — every business that accepts card payments does. What varies enormously is how much of the standard applies. Using a hosted field or redirect that keeps card numbers off your servers reduces the requirements from over 300 to roughly 20.
What is SAQ A?+
The shortest self-assessment questionnaire, for merchants who fully outsource card handling so that card data never touches their systems. If you use a provider's hosted fields or redirect, this is usually the one you qualify for, and it is the reason that integration choice matters so much.
What happens if I am not compliant?+
Monthly non-compliance fees are common. In the event of a breach, fines can reach six figures, and you may be required to fund forensic investigation and card reissuance. In serious cases the acquirer withdraws card acceptance.
Does using Stripe or Paydude make me PCI compliant automatically?+
It makes compliance dramatically simpler but does not remove the obligation. You still complete the appropriate SAQ and keep the scope reduction intact — which means not, for example, logging card numbers or accepting them over the phone into your own systems.