Payment gateway mentioned PCI DSS compliance levels: which level are we and what will it cost?

The critical factor is your payment form architecture. Inspect the source code of the card number input on your checkout page. If that field sits inside an iframe loaded from your payment gateway's domain, you're golden. If you collect it directly via your own form using JavaScript, your scope and compliance overhead go up drastically.

We went through this last year for our site doing around 60k transactions. We logged into the portal our processor linked us to, filled out an SAQ A questionnaire of about 20 questions, and paid an approved scanning vendor $350 for the year. The whole thing took maybe 2 hours.

Just go to your payment provider's dashboard, there's usually a compliance wizard ready to walk you through it. Once you check that you don't store card data and collect payments via a third-party hosted iframe the questionnaire drops down to the bare minimum.

You definitely aren't storing card numbers, expiration dates, or CVVs in your database, right? If you're accidentally printing card data even into log files, the questionnaire type and your liability completely change.

payment processors send these automated warnings every year to scare people. if you're using an embedded form filling out the questionnaire takes 45 minutes tops definitely don't go handing thousands of dollars to an auditor or anything.

Correction: I misremembered the figure, it was a bit lower.

A ton of agencies have popped up in the market asking small businesses for 3,000-5,000 dollars under the guise of 'PCI DSS consulting'. A small merchant that doesn't store card data on their own server doesn't need to spend a single dime on such consultations.

The core rationale behind PCI DSS rules is reducing cardholder data exposure to zero. The further away you keep payment data from your server when building your infrastructure, the lower your legal liability and your annual scanning and compliance costs will be.

when that first email came, we panicked thinking our account would get shut down and called everyone up to our accountant. tbh turns out we just had to check off an online checklist and don't worry at all; if you've moved your system to an external iframe, the process is pretty much painless.

I'm curious too.

There's one point I'm curious about. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If you don't write this down from the start, it leads to arguments later. If you have questions, write them; I'll answer as best I can.

Three different views emerged they all complement each other. Start with a small trial; don't commit to everything at once.

I'm also curious if anyone does it differently.

I've been dealing with this for a long time. Processes without records never improve, because you don't know what to fix.

I'm also curious if anyone does it differently.

My perspective changed after experiencing that. If 2FA is on, a stolen password alone is useless.

If you don't write this down from the start, it leads to arguments later. This is my opinion, I'm not claiming it's absolute truth.

Let me clarify the technical side. Everything goes well for the first three months; problems arise in the fourth.

That's all, sorry if I went on too long.

i completely agree then if you dont write this down from the start it leads to arguments later.

if you post the result here, it will help others too.

We experienced almost the exact same thing last year. Forgotten test environments are more often the entry point than live systems.

Could you elaborate on that? Everyone rushing into pci dss compliance levels gets stuck at the same point.

Mistakes made on the pci dss compliance levels side are usually reversible but expensive. Just leaving this note it might be useful.

Let me speak from the other side; I'm on the supplier side. If you don't write this down from the start, it leads to arguments later.

If you have questions, write them; I'll answer as best I can.