pci dss for online sellers: saq a, data you should never store, and the payment gateway's role

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements designed to ensure that all companies that process, store, or transmit credit or debit card information maintain a secure environment. Its primary goal is to protect sensitive cardholder data against fraud and security breaches. For online sellers, understanding PCI DSS is fundamental, as non-compliance can lead to significant fines, reputational damage, and the inability to process card payments. This is a key aspect within payment security in the digital realm.

Businesses often believe that the complexity of PCI DSS is insurmountable. However, for many online businesses, especially those that delegate card data handling to specialized third parties, the path to compliance is significantly simplified through what is known as the Self-Assessment Questionnaire A, or SAQ A.

SAQ A: simplifying compliance for e-commerce

The Self-Assessment Questionnaire (SAQ) is a document that allows merchants to self-assess their level of compliance with PCI DSS. There are different types of SAQ, each designed for specific payment processing scenarios. For most e-commerce businesses that do not store, process, or transmit sensitive cardholder data directly on their own systems, SAQ A is the most relevant.

SAQ A is intended for merchants whose payment operations meet a key condition: all cardholder data processing has been outsourced to a PCI DSS validated third-party service provider. This means that the merchant's website does not directly access or store the full Primary Account Number (PAN), card verification value (CVV/CVC), or card expiration date on its own servers. In practice, this is achieved through an integration that redirects the customer to a payment page hosted by the payment gateway, or via an iframe or embedded fields that load directly from the gateway, without the card data passing through the merchant's server.

The importance of SAQ A lies in the fact that it drastically reduces the scope of PCI DSS compliance for the merchant. By not handling sensitive data, security responsibilities are primarily limited to securing the merchant's own web infrastructure (to prevent malicious code injections or Cross-Site Scripting that could affect the integration) and ensuring that the payment gateway used is actually PCI DSS compliant.

Data you should never store (or touch)

The golden rule of data security for online payments is simple: if you don't need a piece of data, don't ask for it; if you need it, don't store it if you can avoid it; and if you can't avoid it, store it as securely as possible and only for the strictly necessary time. For merchants covered by SAQ A, this translates into never storing or even touching the full Primary Account Number (PAN), the card verification value (CVV/CVC), or the card expiration date at any point.

Storing any of this data on your own server (even encrypted) would take you out of the scope of SAQ A and oblige you to comply with much more complex and costly PCI DSS requirements, such as those for an SAQ D, which involve extensive audits and network security controls. Furthermore, storing this data exponentially increases the risk in the event of a security breach. If full card data falls into the wrong hands, the consequences can be devastating, including massive fraud, regulatory fines, and irreparable damage to your business's reputation.

A secure practice, when it's necessary to reference a card for, for example, recurring payments, is tokenization. In this process, the payment gateway generates a unique identifier (token) for each card, which the merchant can store securely. This token, by itself, does not contain sensitive card information, and only the payment gateway can link it to the actual card data. Thus, the merchant can initiate future charges without having to directly handle sensitive data. You can delve deeper into the importance of correct data handling and how signed webhooks contribute to this security.

What a PCI DSS compliant payment gateway delegates

Choosing a payment gateway that complies with PCI DSS is the most important decision for an online seller seeking SAQ A compliance. By doing so, the merchant delegates most of the burden of meeting rigorous security standards related to card data handling.

A PCI DSS compliant payment gateway assumes key responsibilities such as:

• Secure storage: The payment gateway is responsible for storing sensitive card data securely and encrypted in its own systems, using high-level physical and logical protection measures.
• Secure transmission: It ensures that all card data is transmitted encrypted (e.g., via TLS) from the customer's browser to its servers, and from its servers to the card brand networks.
• Network and system security: It implements and maintains firewalls, intrusion detection systems, robust access controls, continuous monitoring, and security patches to protect its own systems where card data resides.
• Vulnerability management: It performs regular scans and penetration tests to identify and correct potential security weaknesses.

However, it is crucial to understand that delegation is not total. The merchant remains responsible for:

• The security of their own environment: Ensuring that their website or application is free from vulnerabilities that could compromise the integration with the payment gateway. This includes protection against SQL injections, Cross-Site Scripting (XSS), and other web attacks.
• The choice of a certified payment gateway: Actively verifying that the payment gateway they use possesses a valid Attestation of Compliance (AoC) demonstrating its PCI DSS compliance.
• Proper integration: Ensuring that the integration with the payment gateway is carried out according to best practices and does not introduce vulnerability points.
• Management of other data: The security of any other customer data (addresses, names, purchase history) that is not card data remains the exclusive responsibility of the merchant.

To understand the complete process of how payments are managed and where these security measures come into play, you can consult our article on how an online card payment works.

Practical conclusion

PCI DSS, and specifically the SAQ A option, offers a clear framework for online sellers to operate securely and legally compliant. By choosing a PCI DSS certified payment gateway and adopting appropriate integrations (such as redirects or iframes), your business can delegate the complex responsibility of card data management, minimizing your own risk and the required scope of compliance. The key is not to touch or store sensitive card data and to always maintain the security of your own web environment. This will allow you to focus on your business, knowing that your customers' information is protected.