PCI DSS for E-commerce & SaaS

If card data never touches your servers, PCI gets dramatically simpler -- but v4.x added real obligations for anyone whose site affects the payment page.

SAQ A vs A-EP: the decision that matters

SAQ A applies when you fully outsource card processing (redirect or iframe) and your site doesn't affect payment security. SAQ A-EP applies when your website does affect payment-page security -- typically because you control scripts on the checkout page. Under v4.x, A-EP merchants must inventory those scripts (6.4.3) and run tamper detection (11.6.1). If you're unsure which you are, you're probably A-EP -- confirm with your acquirer.

Tokenization and hosted fields

The cleanest scope reduction in e-commerce: never let card data touch your infrastructure. Hosted payment fields, tokenization, and redirect checkouts move you toward SAQ A -- the shortest questionnaire and the cheapest validation. Every architecture review should ask: can we stop touching card data entirely?

The v4.x script problem

Third-party scripts on checkout pages -- analytics, chat widgets, A/B testing -- are now inventoried, justified in writing, and integrity-checked. Most SaaS companies have never listed theirs. Do the inventory before your assessor asks: it's the most common new-cycle finding.

Realistic costs

SAQ A with clean architecture: $5K–$15K all-in for validation. SAQ A-EP with script remediation: $15K–$60K. Full ROC for a SaaS platform storing card data: $50K–$200K+. See the cost guide for sourced ranges.

Assessors that fit this vertical