This is an old revision of the document!
What Are Your Compliance Requirements?
Though we cannot tell you with certainty what your compliance requirements may be, we can offer a set of guidelines that may help you discern when you do actually need to pay for a service to become compliant (and conversely, when you're being sold misinformation or FUD). This is not an exhaustive list of scenarios, and more information is available at the PCI DSS site if you need clarification.
If you're being told by your merchant account provider or gateway that you need to pay a fee to become compliant, be sure to understand the actual requirements. In many cases you may not need a scan at all, and your SAQ requirements may be quickly and easily completed without paying any additional fees.
| SAQ Required | Scan Required | How you collect payments |
| None | No |
Payments are only handled on a 3rd party system such as through PayPal Express Checkout through FoxyCart or Google Checkout. (These types of payment methods are fundamentally different than a “real” gateway in that the funds are transferred first to the 3rd party (ie. PayPal), then transferred to you. PCI DSS generally only applies to merchants with a Merchant ID, receiving payments directly.)
|
| SAQ A | No |
Payments are handled through your store's FoxyCart checkout using a “real” gateway (ie. a gateway that doesn't redirect the customer to their own hosted payment page).
Payment card details are never handled on the phone or using FoxyCart's Unified Order Entry or with any other virtual terminal. No cardholder data storage, ever. (ie. You never store card numbers, anywhere, ever, at all.)
No fees should be charged by your merchant account provider if you fall under PCI SAQ A (unless breach insurance is required, which is discussed below).
|
| SAQ B | No |
Payments are handled through standalone terminals or are swiped using a machine.
No cardholder data storage, ever. (ie. You never store card numbers, anywhere, ever, at all.)
No fees should be charged by your merchant account provider if you fall under PCI SAQ B (unless breach insurance is required, which is discussed below).
|
| SAQ C | Yes… |
The SAQ C isn't really intended to be used for e-commerce, but rather for individual retail stores.
Payments are entered with a payment system connected to the internet. Systems used to access the virtual terminal may need to be scanned by an ASV.
No cardholder data storage, ever. (ie. You never store card numbers, anywhere, ever, at all.)
|
| SAQ C-VT | No… |
This is new as of PCI DSS 2.0, but it explicitly states “e-commerce merchants will never qualify for this version of the SAQ”, so we won't cover it here. If you're interested though…
Payments are entered into a web browser-based virtual terminal, “via a computer that is isolated in a single location, and is not connected to other locations or systems within your environment (this can be achieved via a firewall or network segmentation to isolate the computer from other systems)”.
|
| SAQ D | Yes, on applicable systems | |
Additionally, there are different merchant 'levels' that you should be aware of if you're doing more than 20,000 Visa transactions per year.
If you can limit your exposure to PCI DSS, we recommend it. Because there is no way to get a fully branded checkout experience without at least some level of PCI compliance, we generally recommend not using any virtual terminal functionality and completing the very short SAQ A. If you do need to use a virtual terminal, you'll likely be required to do the SAQ C. The one thing you really (really) don't want to do is store credit cards on your end, as the requirements become very complex and costly. And since FoxyCart handles this storage for you, there's little reason to spend the months or years and many thousands of dollars on becoming compliant at that level.
