# Compliance Assessment Tool (CAT)

> PCI DSS compliance that merchants can actually finish. Merchants describe how they take card payments in plain English; CAT determines the correct Self-Assessment Questionnaire (SAQ) for each payment method, walks them through it one plain-language question at a time, and produces the official, PCI-form-filled SAQ and Attestation of Compliance (AoC) PDFs. Grounded in PCI DSS v4.0.1 control text, with the merchant confirming every answer — nothing is silently auto-attested.

CAT serves two audiences from one engine:

- **Banks, ISOs, PayFacs and MSPs** (white-label, API-first): add PCI DSS compliance for an entire merchant portfolio under your own brand, with a live portfolio dashboard and signed webhooks. Free sandbox available the same day.
- **Small businesses directly** (restaurants, salons, shops, e-commerce): find out which PCI form you need for free, then complete it for $25 per assessment.

## Integrate (banks, ISOs, PayFacs)

- [PCI DSS compliance API for ISOs, acquirers and PayFacs](https://banks.complianceassessmenttool.com/pci-compliance-api): what it does and how partners launch
- [Choosing a merchant PCI compliance program](https://banks.complianceassessmenttool.com/choosing-a-pci-compliance-vendor): criteria, the four approaches compared, and questions to ask any vendor
- [Starting an ISO or PayFac: your merchant PCI program](https://banks.complianceassessmenttool.com/starting-an-iso): where PCI fits alongside the sponsor bank, processor and gateway, the nine SAQs, renewals and portfolio reporting, and a day-one checklist
- [Merchant PCI program alternatives](https://banks.complianceassessmenttool.com/pci-program-alternatives): how SecurityMetrics, ControlScan and Sysnet (now VikingCloud), VikingCloud, Trustwave's former SecureTrust business and Aperia Compliance compare with an API-first, white-label program, the questions to ask, and how to switch
- [Visa VAMP ratio calculator](https://banks.complianceassessmenttool.com/vamp-calculator): free, in-browser calculator for the Visa Acquirer Monitoring Program ratio ((TC40 fraud + TC15 disputes) ÷ settled card-not-present transactions), with merchant and acquirer thresholds by region and month, the enumeration (card-testing) ratio, and a CSV portfolio mode for ISOs and PayFacs
- [PCI compliance for PayFacs](https://banks.complianceassessmenttool.com/pci-compliance-for-payfacs): who is responsible for sub-merchant PCI DSS validation (acquirer, PayFac, sub-merchant), how the PayFac's integration shapes each sub-merchant's SAQ, and how to build validation into PayFac onboarding by REST API, iframe, redirect or MCP
- [Merchant PCI program for sponsor banks](https://banks.complianceassessmenttool.com/merchant-pci-program-for-sponsor-banks): what Visa and Mastercard hold acquirers responsible for, the per-merchant evidence and portfolio reporting to ask ISO and PayFac programs for, and where merchant PCI fits in third-party risk management
- [PCI compliance API for ISOs](https://banks.complianceassessmenttool.com/pci-compliance-api-for-isos): how an operating ISO puts merchant PCI validation into boarding, its merchant portal and CRM, chooses a delivery path by engineering capacity (bulk CSV invites, redirect, iframe, REST, MCP), tracks renewals and reports to its sponsor bank
- [Integration guide](https://banks.complianceassessmenttool.com/docs): REST API, embeddable white-label iframe, platform redirect (hand-off and return), bulk CSV merchant invites, and an MCP server for AI agents and bank chatbots
- [OpenAPI 3.1 specification](https://api.complianceassessmenttool.com/openapi.json)
- [API reference](https://complianceassessmenttool.docs.buildwithfern.com/): every endpoint, request and response
- [Postman workspace](https://www.postman.com/complianceassessmenttool/cat-pci-dss-compliance-api): a ready-to-run collection — fork it, paste a sandbox key, run the quickstart
- [Apply for a free sandbox](https://banks.complianceassessmenttool.com/signup): sandbox credentials are issued as soon as the applicant's email is verified
- MCP endpoint: `https://api.complianceassessmenttool.com/mcp` (JSON-RPC over HTTPS; authenticate with your partner API key)
- [ROI calculator](https://banks.complianceassessmenttool.com/roi) and [overview deck](https://banks.complianceassessmenttool.com/deck)

## Pricing

- $25 per completed merchant assessment (SAQ + AoC). Free sandbox for integration testing.

## Coverage

- All nine merchant SAQ types under PCI DSS v4.0.1: A, A-EP, B, B-IP, C, C-VT, D (merchant), P2PE, SPoC — plus the merchant AoC.
- One SAQ per payment method, so a business with a counter terminal and an online store gets the correct form for each.

## Trust and security

- [Trust Center](https://banks.complianceassessmenttool.com/trust), [security overview](https://banks.complianceassessmenttool.com/legal/security), [architecture](https://banks.complianceassessmenttool.com/legal/architecture), [sub-processors](https://banks.complianceassessmenttool.com/subprocessors)
- CAT never accepts cardholder data (card numbers, CVV, track data); its schemas have no fields for them.
- [Privacy policy](https://banks.complianceassessmenttool.com/legal/privacy-policy), [terms of service](https://banks.complianceassessmenttool.com/legal/terms-of-service), [SLA](https://banks.complianceassessmenttool.com/legal/sla)

## For small businesses

- [Start free](https://complianceassessmenttool.com/): plain-English questions, no IT knowledge needed
- [Which PCI SAQ do I need?](https://complianceassessmenttool.com/pci-saq-guide): plain-English guide to all nine merchant SAQ types, with a page per SAQ
- [The PCI non-compliance fee](https://complianceassessmenttool.com/pci-non-compliance-fee): what the fee on a merchant statement means and how to stop it
- [SAQ A or SAQ A-EP? Integration by integration](https://complianceassessmenttool.com/saq-a-vs-saq-a-ep): the January 2025 SAQ A rule (who supplies the card form decides; embedded provider fields are SAQ A plus a script-attack criterion), and which SAQ Stripe, Braintree, PayPal, Square, Adyen, Authorize.Net, NMI, Shopify, WooCommerce and Clover checkouts need, with each provider's own source
- [PCI compliance by type of business](https://complianceassessmenttool.com/pci-compliance): plain-English guides; every way a business takes cards is its own payment method with its own SAQ
- [PCI Compliance for Hotels: The SAQ for Each Channel](https://complianceassessmenttool.com/pci-compliance/hotels): which SAQ fits each way a hotel, inn, B&B or vacation rental takes cards (front-desk terminal, PMS-connected terminal, booking engine, phone and authorization forms, OTA virtual cards), plus cards on file, no-show charges and the PMS questions to ask
- [PCI Compliance for Restaurants, Bars and Cafes](https://complianceassessmenttool.com/pci-compliance/restaurants): which SAQ fits each way a restaurant, bar, cafe or food truck takes cards (standalone and pay-at-table terminals, POS systems, online ordering, phone orders, Tap to Pay and phone readers), plus tips, bar tabs, delivery apps and the POS questions to ask
- [PCI Compliance for Retail Stores: Which SAQ Do You Need?](https://complianceassessmenttool.com/pci-compliance/retail-stores): which SAQ fits each way a shop takes cards (counter terminals, POS systems, P2PE, phone and tablet readers at markets, online stores, phone orders), one SAQ per payment method
- [PCI Compliance for Salons, Spas and Barbershops: SAQ Guide](https://complianceassessmenttool.com/pci-compliance/salons-and-spas): which SAQ fits each way a salon, spa, barbershop or studio takes cards (booking-app deposits and cards on file, front-desk terminals, chairside readers, phone payments, gift cards), no-show fees and booth renters, one SAQ per payment method
- [PCI Compliance for Medical, Dental and Vet Practices](https://complianceassessmenttool.com/pci-compliance/medical-and-dental): which PCI SAQ fits each way a medical, dental, chiropractic, therapy, optometry or veterinary practice takes cards (front-desk terminal, patient payment links and portals, phone payments, cards on file, mobile readers), paper card forms, and why HIPAA and PCI DSS are separate
- [PCI Compliance for Small Online Stores: Which SAQ?](https://complianceassessmenttool.com/pci-compliance/online-stores): which PCI SAQ fits each way a small online store takes cards (hosted store checkouts, embedded provider card fields, its own card form, WooCommerce and WordPress plugins, payment links and invoices, marketplaces), the January 2025 SAQ A script-attack criterion, and what changes the SAQ
- [PCI Compliance for Contractors and Home Services](https://complianceassessmenttool.com/pci-compliance/home-services): which SAQ fits each way plumbers, electricians, HVAC, cleaning, moving and auto repair businesses take cards: invoice pay links, phone and tablet card readers (SPoC, MPoC, P2PE), phone payments in a virtual terminal, counter terminals and saved cards for service plans
- [PCI Compliance for Nonprofits, Charities and Churches](https://complianceassessmenttool.com/pci-compliance/nonprofits): why nonprofits are not exempt from PCI DSS, and which SAQ fits each way charities, churches, schools and clubs take cards: hosted donation pages, donation forms embedded on their own website, event card readers and kiosks, text-to-give, recurring gifts and mailed pledge cards

## Contact

- Sales and partnerships: chris.larson@complianceassessmenttool.com
- Security: security@complianceassessmenttool.com

## API for PCI blog (https://banks.complianceassessmenttool.com/blog)

- [Picking the Right SAQ Type for Your Business](https://banks.complianceassessmenttool.com/blog/picking-the-right-saq-type): Learn how to choose the right PCI SAQ type in plain English, why merchants get it wrong, and the real cost of using the wrong questionnaire.
- [Embed SAQ Completion in Merchant Onboarding](https://banks.complianceassessmenttool.com/blog/embed-saq-completion-in-merchant-onboarding): Why ISOs should collect PCI SAQs during onboarding, not months later, and how to build a practical flow merchants actually finish.
- [PayFac PCI validation without a separate portal](https://banks.complianceassessmenttool.com/blog/payfac-pci-validation-without-a-separate-portal): How PayFacs can validate PCI across many sub-merchants inside their own flow, without sending merchants to a separate compliance portal.
- [What Is an API for PCI Compliance?](https://banks.complianceassessmenttool.com/blog/what-is-an-api-for-pci-compliance): What an API for PCI compliance does, what manual PCI workflows it replaces, and how ISOs, PayFacs, and banks can embed it.