Does PCI DSS Level 1 apply to us — which level fits our transaction volume?

It really hinges on whether your site uses an iframe or a direct JavaScript library. If it's a redirect or a standard iframe, you just fill out SAQ A, which is basically checking yes/no on 22-25 items. But if the payment form renders on your own domain, that's SAQ A-EP, which requires quarterly external ASV scans.

That consulting firm is just using textbook fear marketing. I’ve been managing e-commerce infrastructure for 15 years, and I’ve never seen an SME that doesn't clear the 6 million threshold get classified as Level 1. The form the bank sent you is most likely just a boilerplate template they send out for routine annual checks. Ask your bank rep which SAQ type applies to you, don't waste money on an unnecessary audit.

Notifications sent by banks are generally required under BDDK regulations and the annual inventory updates mandated by international card schemes. It should suffice to provide your bank with an official letter stating your transaction volume, confirming that you do not store card data, and clarifying that cardholder data is routed directly through a licensed payment institution's infrastructure.

Has there ever been any suspected card breach on your system in the past, or an unusual wave of chargebacks flagged by the banks? Because even with low transaction volumes, card brands can unilaterally bump a company to Level 1 if a security incident was identified. If nothing like that happened, the quote is completely unjustified.

we use a virtual POS too but where do we doownload this SAQ form and where do we submit it? does an external specialist have to sign off on it, or is a company representative's signature enough?

Before spending a single cent, log into your payment gateway's portal. Most payment providers provide their own PCI DSS certificate and a pre-filled SAQ attestation for you under the compliance tab for free. Downloading that and forwarding it to the bank usually sorts it right out.

We went through the exact same thing last year with similar volume. We filled out the SAQ A form, stamped it, sent it to the bank, and that was it. We just had external vulnerability scans run twice a year on our site, which cost us around 6.000 TL in total. 180.000 TL is straight-up highway robbery.

The cheap-looking path usually ends up costing more later. Having backups accessible on the same network and with the same identity makes them part of the target.

That's all, sorry if I went on too long.

Correct. If you scold false alarms, nobody will report again.

Correct me if I'm wrong.

The cheap-looking path usually ends up costing more later. Most incidents start with a leaked password, not a vulnerability.

Hope this helps.

This thread is archived.

I think differently. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Hope this helps.

don't miss this: If you don't write this down from the start it leads to arguments later.

there's also a measurement aspecct to this... if you scold false alarms nobody will report again.

taking measures without an inventory leaves doors you haven't seen open.

This is exactly what we experienced. Security isn't absolute; it's about making attacks not worth the effort.

I'm also curious if anyone does it differently.

I agree. When making decisions, write down the worst-case scenario too not just the best.

Payment information changes are never verified through the channel they came from. Correct me if I'm wrong.

This approach has a cost which isn't discussed. Processes without records never improve because you don't know what to fix.

If you have questions, write them; I'll answer as best I can.

quik summary for newcomers: Everything goes well for the first three months; problems arise in the fourth.

proven by experience.