PCI-DSS Compliance for E-Commerce

PCI-DSS is the card industry’s standard for handling card data, and the simplest way to reduce its scope is to never hold that data. Checkout sends cards straight to your gateway.

Share your requirements

Keeping card data off your servers

Every card number stored on your server widens what has to be protected and audited. Most online stores have no need to hold one.

Hosted or gateway-hosted fields

The card is entered on the gateway’s own page or inside its secure field on your checkout, so the number passes straight to the gateway. Your server never sees it.

Tokens for repeat customers

The gateway returns a token for saved cards and mandates. A token is of no use to anyone who steals it.

Nothing in logs or email

Card and CVV values are kept out of logs, support tickets and order confirmation emails, where careful stores often leak them.

What remains with the merchant

Reduced scope is not zero scope. Some obligations stay with the merchant whatever the checkout looks like.

The self-assessment questionnaire

Your acquirer decides which questionnaire applies. The sign-off is yours.

Access control and passwords

Admin accounts, roles, second factor, and removal of people who have left.

Patching and vulnerability scanning

Platform and server versions are kept current, with vulnerability scans run where your merchant level requires them and the results filed with your records. Old versions are retired.

Your vendors

Gateway, hosting and any tool that touches the payment page form part of your answer. The list of them belongs in the file too.

What we do and do not claim

Owners are sometimes sold certainty that nobody can supply. Our claims are limited to what we build.

We are not an assessor

The store is built and configured to the standard. Certification comes from a qualified assessor or from your acquirer, never from a development company.

No compliance badge claims

A store is not compliant because a plugin says so.

Written down for the next audit

Where card data flows, who has access and which controls exist are all recorded, so the next questionnaire starts from a document.

FAQ

Frequently asked questions

Does PCI-DSS apply to a small Indian store?

Yes, in proportion. A merchant accepting cards has obligations. A store on hosted checkout that stores no card number usually has the shortest questionnaire, and your acquirer confirms what applies.

Can we save customer cards for faster checkout?

Yes, through your gateway’s tokenisation. That is the only route we implement. Storing card numbers yourself brings audit obligations that a small store should avoid.

Will you certify our store?

No. Certification is issued by a qualified assessor or your acquiring bank. The store is built, configured and documented so that an assessment is straightforward.

Talk to us

Tell us what you need.

Share your requirements and one of our engineers will come back to you within one business day.

No obligation
A reply within one business day
Your details stay private

Start with your requirements

Seven short steps that tell us what you need. An engineer reads them before getting in touch.

Share your requirements