Choose a checkout that keeps you on SAQ A

How to do it

PCI DSS v4.0.1 is the card industry's security standard. The self-assessment questionnaire (SAQ) you file depends on how card data moves. A redirect to a hosted page, or iframe fields served by the provider, qualify for SAQ A. If your own script builds the card form or posts card data to the provider, you move to SAQ A-EP, with many more requirements. Since its January 2025 revision, SAQ A also requires that the page holding the iframe is safe from script attacks. PCI FAQ 1588 allows two ways to show this. Protect that page yourself as in requirements 6.4.3 and 11.6.1, or get the provider's written confirmation that its integration includes that protection. Load the provider's script from the provider's own domain, never from a copy. The attack test for card data is in hosted payment fields.

Example

Hosted payment page (redirect)              -> SAQ A
Provider iframe fields on your page         -> SAQ A, plus script protection or the provider's confirmation
Your own fields that post to the provider   -> SAQ A-EP
Card numbers reach your server              -> SAQ D

How to check

Search the frontend for card inputs outside the provider's iframe, such as autocomplete="cc-number", cc-csc or inputs named card, cvc or cvv. None exist. Every page that loads the provider's script loads it from the provider's domain. The provider's confirmation, or your script inventory for 6.4.3, is stored in the repository.