My bank sent a PCI DSS notice and I don't know what they want.
We read the acquirer's requirements, confirm your merchant level and the right SAQ (Self-Assessment Questionnaire) type, and turn it into a plain task list.
Take card payments with less risk: PCI DSS for your store
PCI DSS (the card payment security standard) is required by acquiring banks and card brands. We work out what it means for your site, shrink the part of your system that touches card data and prepare the documents.
Quote and schedule after your brief
Who it's for
- Online stores taking cards through Stripe, Adyen, PayPal, Shopify Payments or similar
- Owners whose acquirer or payment provider asked for a PCI DSS questionnaire
- Stores with custom checkouts, plugins or a CRM that handles orders
- Merchants selling to the EU, UK, US, Canada or Australia who want clear compliance documentation
Problems we solve
I'm not sure whether card data touches my server.
We trace the payment from cart to payment page: forms, scripts, logs, databases and email. We show where card data enters your system and remove those points.
Third-party scripts on checkout could steal card details.
We inventory every script on the payment page, remove what isn't needed, lock down what stays and set a Content Security Policy (rules that stop unknown code from loading).
I'm afraid it will pass once and break within a year.
You get a short maintenance routine and a review calendar. Optionally we add automated alerts for page changes and overdue updates.
What's included
- Review of acquirer and payment provider requirements, SAQ type and merchant level
- Payment flow map showing where card data passes and where it stops
- Move to a hosted payment form (redirect or iframe) so card numbers never reach your server
- Inventory of scripts, plugins and third-party services on cart and checkout pages
- HTTPS, current TLS versions and security headers
- Content Security Policy for the payment page
- Admin hardening: two-factor authentication, separate accounts, access roles
- Search for card data in logs, databases and email, with cleanup
- SAQ completion and a document pack for your bank or provider
- Maintenance routine and a calendar of repeat checks
Choose the scope
Use a package to describe what you need. We agree on the quote and schedule after reviewing your brief and requirements.
01
Audit
For merchants who got a notice and need to understand the scope first
- Requirements review
- Payment flow map
- SAQ type confirmation
- Risk report with an action plan
02
SAQ A end to end
For stores that can hand the full payment step to a provider
- Move to a hosted payment form
- HTTPS and security headers
- Admin protection: 2FA, roles, access
- SAQ A completed
- Document pack for your bank
03
Custom checkout
For stores with custom payments, integrations, a CRM or their own server
- Everything in SAQ A end to end
- Logs, databases and integrations checked for card data
- CSP and script control on the payment page
- Change alerts via an AI agent and automated checks
- Preparation for an external audit, if your bank requires one
How we work
Collect inputs
We ask for the acquirer letter or contract, your payment provider name, and access to the site and hosting. All accounts stay yours.
Map the payment path
We show where card data flows and which systems fall within PCI DSS scope. This sets the workload and the SAQ type.
Shrink the risk area
We move payment entry to the provider, remove extra scripts and stored data, and close unneeded access.
Verify and complete the SAQ
We run the checklist, gather evidence and fill in the questionnaire. You sign it yourself, because the merchant is responsible for the answers.
Hand over the routine
You get instructions, a review calendar and a list of changes that need a new assessment. Payment is made in stages.
Scope and limits
- We don't issue a PCI DSS certificate. We are not a QSA (Qualified Security Assessor). If your bank requires an external audit, we help you prepare for the assessor.
- We can't guarantee your bank accepts the documents on the first try. The decision is theirs. We prepare to their requirements.
- We don't make you compliant for life. A change to your site or payment provider means a new review.
FAQ
Do I need PCI DSS if I use Stripe or PayPal?
Yes, but the scope is much smaller. You are still responsible for your own site, and most such merchants complete the shortest questionnaire, SAQ A. Your acquirer or provider confirms the type, and we help you verify it.
What is an SAQ?
It is a self-assessment questionnaire about how you accept cards and protect your systems. The type depends on your payment setup. The less card data touches your server, the shorter it is.
Can I store card numbers in my own database?
Technically yes, but the requirements grow sharply and so does the risk. For most stores we advise not storing card numbers at all and using tokens (stand-ins for the card) from the payment provider.
Can you pass the audit for me?
We prepare the system, collect evidence and complete the SAQ based on checks. The business owner signs it. External audits are done only by an accredited QSA.
What do I need to provide?
The letter or contract from your bank, payment provider details, and access to the site, hosting and admin. Also a list of plugins and services that see orders. If something is missing, we find it during the audit.
How much does it cost, and are there yearly fees?
We prepare a quote after reviewing your brief. We list support and any third-party costs separately: subscriptions, APIs, hosting or media spend where the project needs them. Provider rates are checked before work starts.
Start with your task
Describe your business, the outcome you need and your current workflow. We will clarify the requirements and prepare a quote after your brief.