Compliance Assessment Tool
Home › PCI compliance by business › Salons, spas and barbershops

PCI compliance for salons, spas, barbershops and studios

Short answer. A salon, spa or barbershop completes one PCI Self-Assessment Questionnaire (SAQ) for each way it takes cards, not one for the whole business. Deposits and cards on file collected by an online booking provider are usually SAQ A, a standalone front-desk terminal is usually SAQ B-IP (or SAQ P2PE if it is part of a PCI-listed P2PE solution), and cards read out over the phone and typed into a virtual terminal are usually SAQ C-VT. Booth renters with their own merchant accounts handle their own PCI compliance, and your acquirer has the final say.

PCI DSS (the Payment Card Industry Data Security Standard) is the card industry's security rulebook. A small business shows it follows the rules by completing a Self-Assessment Questionnaire, or SAQ, usually once a year, for its acquirer: the bank or processor that pays your card sales into your account.

Salons show why the way you take cards matters more than the kind of business you run. A typical studio takes a deposit when a client books online, keeps a card on file for its no-show policy, charges the balance at the front desk, and now and then takes a card over the phone. That is three or four payment methods, and each one has its own SAQ.

PCI SSC, the council that writes the standard, says a merchant with several payment channels may complete a separate SAQ for each one, as long as each channel meets that SAQ's conditions and the channels are kept apart (PCI SSC FAQ 1082). The same applies whether you run a hair or nail salon, a spa, a barbershop, a massage practice, a lash studio or a tattoo studio.

How salons, spas and barbershops usually take cards, and the SAQ for each

Each way you take cards is its own payment method, and each one gets its own SAQ. Most businesses have two or three.

Payment methodUsuallyWhy
Online booking with deposits or cards on file
Clients book through your booking app or the booking page on your website and pay a deposit, prepay the service, or leave a card on file for your cancellation and no-show policy.		 SAQ A / SAQ A-EP
Usually SAQ A when the booking or payment provider collects the card		 The client types their card into the provider's own booking page, or into the provider's secure card fields embedded in your site, so the card number goes to the provider and never to you. A later no-show charge uses the card the provider stored; you only ever see the last four digits.
Watch out: If the provider's card fields sit inside your own website, you also confirm your page is protected against malicious scripts, usually with the provider's written confirmation (PCI SSC FAQ 1588). If your own site builds the card form, it is SAQ A-EP. Staff typing clients' cards into the booking software is a separate payment method (see phone bookings).
Front-desk card terminal or salon POS
The card machine at reception, or the card reader that comes with your salon software and connects to the front-desk computer or tablet, where clients pay for services, tips and retail products.		 SAQ B-IP / SAQ C / SAQ P2PE
SAQ B-IP for a standalone internet-connected terminal, SAQ C if the reader feeds your salon software, or SAQ P2PE if it is part of a PCI-listed P2PE solution		 A standalone terminal talks only to your processor, so only the terminal and its connection are checked. When the reader feeds the front-desk computer or tablet running your salon software, that device is part of the payment flow, which is SAQ C, unless the readers belong to a validated P2PE (point-to-point encryption) solution.
Watch out: Keep the terminal off the Wi-Fi your clients and booth renters use. An older terminal that dials out over a phone line is SAQ B. A brochure that says the reader is encrypted is not the same as PCI-listed P2PE.
Chairside or mobile card reader
A small reader paired to your phone or tablet for taking payment at the chair or treatment room, at a pop-up, or on mobile and in-home appointments such as massage or bridal hair; or a Tap to Pay app on your phone.		 SAQ SPoC
SAQ SPoC if your provider's solution is PCI-listed as a SPoC solution; otherwise ask your provider which SAQ their solution supports		 A phone is an everyday device that runs other apps, so PCI treats this setup as low-risk only when the whole solution, reader and app together, has been validated and listed by PCI SSC. SAQ SPoC is written for listed SPoC solutions: a secure card reader paired with a phone or tablet.
Watch out: Phone-only contactless apps fall under other PCI standards (CPoC or the newer MPoC) that have no SAQ named after them, so ask your provider which SAQ they support and confirm it with your acquirer.
Phone bookings and cards taken over the phone
A client calls to book, pay a deposit or buy a gift card and reads out their card, and the receptionist types it into the processor's virtual terminal (a payment web page) or the card field of your booking software on the front-desk computer.		 SAQ C-VT / SAQ A
SAQ C-VT if staff type cards into a virtual terminal, or SAQ A if you text or email the client a payment or booking link instead		 When staff type the card, the front-desk computer handles the card number, so it needs protecting. With a link, the client enters their own card on the provider's page and your systems never see it.
Watch out: Typing cards into your booking software's staff screen is usually assessed like a virtual terminal; ask your booking provider. Never accept card numbers by text, email or social media messages: receiving them electronically rules out SAQ C-VT.
Online shop for gift cards and products
Gift cards, treatment packages or retail products sold on your website or a separate web shop.		 SAQ A / SAQ A-EP / SAQ D
Usually SAQ A when your payment provider supplies the checkout page or its secure card fields		 Who supplies the card form decides, as for any online shop. If it is the same booking provider's checkout you already use for deposits, it is the same payment method; a separate web shop is another one.
Watch out: If your own website builds the card form, it is SAQ A-EP. If card numbers ever reach your own server, it is SAQ D.

Find out which SAQ fits each way you take payments, free

Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.

Cards on file and no-show fees: let the booking app keep the card

A no-show or late-cancellation policy is the main reason salons end up holding card details. The safe way to do it is to let your booking or payment provider store the card when the client books. The provider keeps the card number and gives you a stand-in reference (often called a token), so you can charge the fee later while only ever seeing the last four digits. That keeps the channel on SAQ A.

The unsafe way is writing card numbers in the appointment book, on index cards, in phone notes, in a client spreadsheet, or keeping the text a client sent. Storing card numbers electronically takes you out of every short SAQ and into SAQ D, the full questionnaire. Never keep the three- or four-digit security code at all.

Booth renters, suite renters and independent stylists

Many salons rent chairs, booths or suites to independent stylists, barbers, nail techs and therapists. For PCI, what matters is whose merchant account the money goes into. A renter with their own merchant account, their own reader or booking app, and payouts to their own bank account is a separate merchant. They are responsible for their own PCI compliance and their own SAQs, just as you are for yours. You do not file for them.

If a renter's clients pay on your front-desk terminal and the money lands in your account before you pay the renter, those are your card payments under your merchant account. They are covered by your SAQ for that terminal, and you are responsible for how they are handled. Agree with each renter which way they take payments, so nobody's cards fall between the two.

Shared space still matters. Renters' phones and readers often join the salon Wi-Fi, so keep your own terminal on a separate network that a renter's or client's device cannot reach. And if renters pay you rent by card, that is one more way you take cards, with its own SAQ.

Gift cards

Selling a gift card is not a separate payment method. The client pays for it at the front desk, online or over the phone, and that payment falls under that method's SAQ.

The gift cards themselves are a different question. PCI SSC says prepaid and gift cards that carry a payment-brand logo, such as a Visa or Mastercard gift card, may fall under that brand's compliance programs (PCI SSC FAQ 1039). A gift card that works only at your salon carries no card-brand logo, but its numbers are still worth money: keep balances in your gift card or POS provider's system rather than a spreadsheet, and ask that provider how it protects them.

Chairside readers and Tap to Pay

A reader on your phone or tablet only qualifies for a short SAQ when the whole solution, reader plus app, has been validated and listed by PCI SSC. SAQ SPoC is written for one kind of listed solution: a secure card reader paired with an off-the-shelf phone or tablet (SPoC stands for Software-based PIN entry on COTS, meaning commercial off-the-shelf devices).

Phone-only contactless apps, often sold as Tap to Pay, are not SPoC solutions. PCI SSC covers them under its CPoC and newer MPoC (Mobile Payments on COTS) standards, and there is no SAQ named after either. In May 2026 PCI SSC announced that it will stop accepting new SPoC and CPoC submissions after 31 October 2026, pointing solution makers to MPoC; existing listings stay valid until their own expiry dates. Ask your provider which PCI SSC listing their solution has and which SAQ they support, then confirm with your acquirer.

Protect the front desk

The front desk is where most salon card data passes, so a few habits from PCI SSC's guide for small merchants go a long way.

Your checklist

  1. List every way you take cards: booking app deposits and cards on file, the front-desk terminal, chairside readers, phone payments and any online shop.
  2. Ask your booking provider whether clients enter cards on its own page or in its fields embedded in your website; if embedded, get its written confirmation about script protection.
  3. Move no-show and cancellation cards into your booking app's card-on-file feature, and shred or delete any card numbers you have written down or received by message.
  4. Ask your processor how the front-desk terminal connects, whether it is wired to your salon software, and whether it is part of a PCI-listed P2PE solution.
  5. Move the terminal onto a network separate from client and renter Wi-Fi.
  6. For a chairside reader or Tap to Pay app, ask the provider which PCI SSC listing it has and which SAQ they support.
  7. Agree with each booth renter whose merchant account their clients' payments go through.
  8. Photograph and list every terminal, and check them for tampering on a regular schedule.
  9. Complete one SAQ per payment method and send them to your acquirer in the way it asks.

Common questions

Does my booking app make me PCI compliant?

Not on its own, but it does most of the work for that payment method. If the booking provider collects the card, you usually complete the short SAQ A for online bookings. Your front-desk terminal, phone payments and any other way you take cards each need their own SAQ.

Can I keep clients' card numbers for no-show fees?

Not yourself. Use your booking or payment provider's card-on-file feature, which stores the card for you and lets you charge the fee later. Writing card numbers down or saving them in a spreadsheet or phone notes puts you at risk and, if stored electronically, moves you to SAQ D.

I take deposits online and payments at the front desk. Is that SAQ D?

Not just because there are two payment methods. PCI SSC FAQ 1082 says a merchant may complete a separate SAQ for each channel, as long as each one meets that SAQ's conditions and the channels are kept apart. Booking-app deposits and a standalone front-desk terminal are typically SAQ A and SAQ B-IP. Check with your acquirer.

Do booth renters need their own PCI compliance?

Yes, if they take cards through their own merchant account: they are a separate merchant with their own SAQs. If their clients pay on your terminal into your account, those payments are yours and fall under your SAQ. What decides it is whose merchant account the money goes into.

Which SAQ covers taking a card over the phone?

If your receptionist types the card into your processor's virtual terminal, usually SAQ C-VT, which covers protecting that computer. If you send the client a payment or booking link and they enter the card themselves, the provider handles it and it is usually SAQ A. Never take card numbers by text or email.

Is a tattoo studio or massage practice any different?

Not for PCI. The SAQ follows how you take cards, not the service you provide. A tattoo studio taking deposits through a booking provider and the balance on a counter terminal has the same two payment methods, and the same SAQs, as a hair salon set up the same way.

Who decides which SAQ I file?

Your acquirer: the bank or processor that handles your card payments. PCI SSC tells merchants to check with their acquirer or the card brands. Use this guide to work out what to ask for, then confirm with them.

Ready to see your SAQs?

Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.

Other businesses

Hotels and lodgingRestaurants, bars and cafesRetail storesMedical, dental and veterinary officesSmall online storesContractors and home service prosNonprofits and charities

Sources

General guidance, not legal advice. Your acquirer or payment processor decides which SAQ you must file. PCI DSS v4.0.1; content checked 2026-10-23.