PCI compliance is where small businesses either overpay for consultants or ignore it and pay the penalty fee forever. Neither is necessary. The choice of how your checkout collects the card determines almost everything about your obligation, and the right choice puts nearly every small business on the shortest questionnaire. This page explains the options and what each one commits you to.
Four ways a gateway can collect a card
| Method | How it works | Card data touches your site? | Typical SAQ |
|---|---|---|---|
| Hosted payment page | Customer redirected to the gateway’s page, returns after payment | No | A |
| Hosted fields / tokenizer | Card inputs are iframes from the gateway embedded in your checkout | No | A |
| Direct post / client-side API | Your form posts card data straight from the browser to the gateway | Your page controls the form, data bypasses your server | A-EP |
| Server-side API | Card data passes through your server to the gateway | Yes | D |
| Virtual terminal | Staff key cards into the gateway’s web page | No, but your workstation does | C-VT |
Hosted page and hosted fields are the answer for almost everyone. Direct post is for developers who need full control of the form and accept a longer questionnaire. Server-side is for platforms with security staff.
What the SAQs actually require
- SAQ A. Around 30 questions. Confirms you outsource card handling to validated providers, do not store card data, and manage the parts you do control (like who can log into the gateway). No quarterly scan required in most cases. An afternoon, once a year.
- SAQ A-EP. Around 190 questions plus quarterly external vulnerability scans of your website. Needed when your page has control over how the card form is delivered, even if data goes straight to the gateway. This is the trap: a web developer picks a “direct” integration for design reasons and the merchant inherits a much larger burden.
- SAQ C-VT. Around 80 questions. For merchants keying cards into a virtual terminal from a dedicated computer that is not connected to other systems that store card data.
- SAQ D. Over 300 questions plus scans plus, at some volumes, penetration testing. For anyone storing, processing or transmitting card data on their own systems. Avoid unless you are a software company.
Tokenization and vaults
Every serious gateway has a vault. The first time a customer pays, the gateway stores the card and gives you a token. Your software, your virtual terminal, or your recurring billing schedule charges the token afterward. Tokens are tied to your gateway account and useless anywhere else.
What this means in practice: no card numbers in your CRM, spreadsheets, paper files or email. Ever. If a customer emails you a card number, charge it, then delete the email. Repeat customers get stored in the vault with their permission.
When you switch gateways, the vault migrates: the old gateway exports encrypted tokens and card data to the new one, and your customer IDs are remapped. The process for Authorize.net is in switching from Authorize.net.
Hosted pages: what you give up and what you get
You give up some design control. The page lives on the gateway’s domain, and while you can add a logo, colors and your business name, it will not be pixel-identical to your site. Hosted fields solve most of that by putting only the card inputs in iframes.
You get SAQ A, no scans, no liability for card data on your server, a payment form that is maintained and updated by the gateway (including 3D Secure and wallet support as they change), and the ability to move gateways without rebuilding your checkout.
Where PCI fees come from
There is no fee to be PCI compliant. There are two fees on statements that reference it:
- PCI compliance fee ($5 to $30 a month). A processor charge for providing the compliance portal and scan service. Some charge it, some do not. It is negotiable.
- PCI non-compliance fee ($20 to $99 a month). A penalty for not completing the SAQ and scans. It is entirely avoidable. Merchants pay it for years because nobody told them what it was.
On a statement review we find the non-compliance fee on about a third of accounts. Completing the questionnaire takes an afternoon. Our statement guide shows where to find it.
Setup with us
We configure the gateway’s hosted page or hosted fields on your cart, enable the vault, confirm the integration keeps you on SAQ A, and sit with you for the questionnaire once. After that it is an annual renewal you can do yourself.