PCI DSS SAQ Selector
Almost every PCI question comes down to one thing: how you accept card data. This selector narrows it to the questionnaire that matches your integration.
How this tool works
The questionnaire is selected by two factors: how the cardholder enters the data, and whether you keep it. A merchant that hosts its own payment page and stores nothing qualifies for the smallest questionnaire, SAQ A. Add a shopping cart or an electronic storage of card data and the requirement moves to SAQ A-EP. Hand the page to a third party and the merchant becomes SAQ D, the full standard. A validated tokenisation provider can bring a card-not-present merchant back down to SAQ A-EP.
When to use it
- Scope a compliance programme before buying a scanner
- Answer a customer's security questionnaire
- Decide whether you need an SAQ or a full assessment
- Plan tokenisation to reduce scope
Frequently asked questions
What is SAQ A?
The smallest questionnaire, for merchants who do not store card data and delegate the payment page to a PCI validated provider.
What is the difference between SAQ A and SAQ A-EP?
SAQ A-EP applies when the merchant hosts the payment page or electronically stores card data, even if it does not keep the data after authorisation.
What is SAQ D?
The full PCI DSS assessment, for service providers and merchants that store or process card data directly.
Does tokenisation reduce my scope?
Often. A validated tokenisation flow can let a card-not-present merchant qualify for SAQ A-EP instead of SAQ D.