We take in-store POS and online payments — what exactly does PCI DSS compliance want from us?

No need to panic at all, the legal jargon in standard bank emails always freaks people out for no reason. As long as you never store the card number, expiry date, or CVV code in your database, your only job is filling out the right form and signing it.

Three things you should check right away: 1) Verify whether card details are entered directly inside the payment provider's iframe/window on your site, 2) Make sure card numbers are properly masked on your physical POS receipts, 3) Request the applicable SAQ template directly from your bank rep.

Some consulting firms out there exploit SMEs' lack of knowledge on this and quote $5,000 to $10,000 as if you actually need a Level 1 audit. Don't fall for it, at your volume you definitely don't need to hire an external audit firm.

We got the exact same notice when we were doing around 80,000 transactions a year. Since our payment flow was redirect-based, we just filled out SAQ A and sent in our website's SSL and security scan. The whole thing was approved by the bank in 2 days and cost us zero lira.

if u don't store cards on your server there's nothing to worry about. main thing is keeping the site's admin password strong and the ssl cert up to date. just fill out the form and send it to the bank.

when I first got that email, I thought we were gettinng shut down; the terminology is so intimidating it scares the hell out of you then but once you look into it you realize the bank is basically just asking for your signature to confirm "you're not holding any card info on your end right?"

Please review your technical integration type specified in your merchant agreement with your payment processor. If you collect card data directly via API, you may fall under SAQ A-EP; in that case, the requirements and security controls will be somewhat more stringent.

Check in with your software agency and get confirmation on whether your site processes or logs card data in any way. If the answer is no, tell the bank you'll be submitting SAQ A, take 30 minutes to fill it out, and put the matter to rest.

Good call starting this thread.

I feel the same way... like start with a small trial; don't commit to everything at once.

I completely agree. btw solutions that work at a small scale collapse when you grow; I learned this late.

If I were you I'd go this route.

There's a trap here, let me mention it. Hasty decisions become decisions you have to fix six months later.

This is my opinion, I'm not claiming it's absolute truth.

Great work. Start with a small trial; don't commit to everything at once.

Everything goes well for the first three months; problems arise in the fourth. If you have questions, write them; I'll answer as best I can.

ive been down this road let me tell you. most time waste accumulates in tasks waiting for approval.

Same here.

I feel the same way. Hasty decisions become decisions you have to fix six months later.

Just leaving this note it might be useful.

Saved.

We need to take it step by step. Most time waste accumulates in tasks waiting for approval.

Correct me if I'm wrong.