Payment provider is asking for PCI-DSS certification — is it really necessary, what does it cost?

Nothing to worry about. If you never see the card numbers on your server, expensive audits don't apply to you. Open the SAQ A form, answer questions like "do you handle card data" along the lines of "outsourced to provider", and submit it. We renew ours every year in 15 minutes.

The technical distinction is critical: even if the form is embedded on your site, if the data is sent directly to the payment gateway's API in the background, you fall under SAQ A-EP and need quarterly vulnerability scans. But if you use a full redirect or an iframe, you only need the simple SAQ A, with no external scans required.

We got the same notice last year, and auditing firms quoted us 4,000 €. Then we reached out to our payment gateway's support team, and they pointed us to their partner portal. We paid a 60 € annual portal fee, filled out the 20-question SAQ A survey, and got approved.

Just call your payment gateway's support right away. Tell them you use a redirect and ask how to submit the SAQ A document via the dashboard. They'll send you a link to their online validation page, and you'll be done in half an hour.

Let me summarize the process step-by-step: 1) Verify your integration type (redirect or API?). 2) Identify the right form (most likely SAQ A). 3) Complete the wizard in the provider's portal. 4) Save the resulting Attestation of Compliance to your records.

got the exact same email panicked and talked to support right away... turns out u just answer a few questions in the portal. dont pay any money just do it yourself in the dashboard.

Payment gateways word these emails aggressively to scare you, making it sound like an auditor will show up at your door tomorrow. Their main goal is often to sell monthly or annual subscriptions to their partner compliance portals. Don't panic and don't hire an outside consultant.

Even if you do not store credit card data, the security of the server hosting your website is critical during the cardholder redirection phase. Therefore, even at the SAQ A level, this requirement is mandated by the international card schemes. I advise you to complete the submission within the deadline.

Just a heads-up. Everything goes well for the first three months; problems arise in the fourth.

If you post the result here, it will help others too.

Correct.

Same here. People defend habits not processes. Resistance comes from there.

Solutions that work at a small scale collapse when you grow; I learned this late. If you post the result here it will help others too.

I disagree with you on this point. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Payment information changes are never verified through the channel they came from. Correct me if I'm wrong.

I didn't know that. An automated scan report is not the same as a penetration test.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

We experienced almost the exact same thing last year. If the notification path is long notifications don't arrive; missing notifications mean delayed incident detection.

If it's your first time, start small; scaling comes later. Of course, it varies if your situation is different.

Yes that's exactly how it is with pci dss certification. Your time to detect an issue directly determines its cost.

Just leaving this note it might be useful.

Let me share what happened to me; it might be useful. Everyone rushing into pci dss certification gets stuck at the same point.

I'm also curious if anyone does it differently.

You're right.

Let me summarize what's been said so far. Payment information changes are never verified through the channel they came from.

If you post the result here, it will help others too.