Checkout and card data

Required

• Choose a checkout that keeps you on SAQ A

  Required

  Take card details only through the provider's hosted payment page or its iframe fields, so you qualify for the shortest PCI DSS self-assessment, SAQ A.

• Handle 3-D Secure in every card flow

  Required

  Send every card payment the customer starts through the provider's 3-D Secure step, and handle the result that asks for customer action.

• Save cards with consent and charge renewals off-session

  Required

  To charge a card later, save it at the first payment with SCA and the customer's consent. Mark each later charge as merchant-initiated.

• Keep prices in a versioned catalogue

  Required

  Keep every price in one server-side catalogue with a stable ID, and create a new price instead of changing the amount of one in use.

• Keep test and live modes apart

  Required

  Use the provider's test mode in every environment except production, and make the app refuse to start with a live key anywhere else.

• Test every payment outcome with test cards

  Required

  Keep one automated test for each payment outcome, using the provider's test cards and test clocks, and run them before every release that touches payments.