Compliance / PCI DSS
PCI DSS complianceWe help merchants and service providers shrink their cardholder data scope, close gaps against PCI DSS v4.0.1 and prepare for their self-assessment questionnaire or QSA assessment.
If you store, process or transmit cardholder data, or can affect its security, PCI DSS applies.
Our PCI DSS self-assessment checks your program against the 12 requirements.
Segmentation, tokenization and outsourcing can shrink the systems PCI DSS applies to.
Eligible merchants validate with the SAQ that matches how they take payments.
Larger merchants and many service providers are assessed by a Qualified Security Assessor.
PCI DSS v4.0.1 is the current version. Its future-dated requirements became mandatory on March 31, 2025.
Map where card data flows and find ways to reduce it.
Measure your program against the requirements in scope.
Close gaps, including the v4.0 requirements many teams missed.
Policies, procedures and evidence your SAQ or QSA will ask for.
Complete your SAQ or support your QSA through the assessment.
QSA assessment fees are separate.
The v4.0.1 requirements, ways to shrink scope and what your SAQ or QSA will ask for.
Download →It depends on how you accept payments and whether card data touches your systems. We help you pick the right one.
Your merchant or service provider level, and your acquiring bank, decide whether you self-assess or need a QSA.
Outsourcing reduces scope but rarely removes it. You still have requirements for the systems that connect to your provider.
Yes. PCI DSS requires regular internal and external penetration testing for systems in scope.
Book a 30-minute call. We’ll look at how you take payments and show you where scope can come down.