PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) is the set of security rules for any business that stores, processes, or sends card data. The major card networks created it to protect cardholder data. The current version is v4.0.1, and its future-dated requirements became mandatory on March 31, 2025.

What it covers

• Protecting card data. Encrypt it in storage and in transit, and never store the CVC after authorization.
• Securing networks. Use firewalls, change vendor default passwords, and separate systems that touch card data.
• Controlling access. Limit who can reach card data and log every access.
• Testing. Scan for vulnerabilities and monitor systems all the time.

How you prove compliance

Most small businesses fill out a Self-Assessment Questionnaire (SAQ). The shortest one, SAQ A, applies when a compliant provider handles all card entry, such as a checkout page hosted by your payment gateway. Since the January 2025 SAQ A update, merchants must also confirm their site is protected against scripts that could steal card data.

How to reduce your PCI work

Don't handle raw card data yourself. If your provider collects and stores the card through tokenization, your servers only see a token. The provider then carries most of the requirements. A hosted checkout or a payment method token keeps card data off your systems entirely.