Compliance Assessment ToolSAQ A: who needs it?
SAQ A is for businesses that sell online or by mail/phone order but never touch card numbers themselves — the customer types their card into a checkout page run entirely by your payment provider.
This is probably you if…
- You only take card-not-present payments (online, or mail/phone orders handled entirely by your provider).
- Your customers enter card details on a page hosted by your payment provider, not on your own website.
- Nothing you own — website, computer, phone, spreadsheet — ever receives or stores a card number.
Typical setups
- A Shopify, Squarespace, Wix or BigCommerce store using the platform's hosted checkout.
- A site that sends customers to PayPal, Stripe Checkout or Square Online to pay.
- Any "Pay now" button that redirects the customer to the payment company's own page.
It's probably not SAQ A if…
- Your own website draws the checkout page and embeds the card fields (even inside the provider's iframes) — that is usually SAQ A-EP.
- Your staff type card numbers into a web page for phone orders — that is usually SAQ C-VT.
- You also take payments in person — that channel needs its own assessment.
Not sure it's SAQ A?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ A, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ A, the PCI Security Standards Council requires all of the following:
- The merchant accepts only card-not-present (e-commerce or mail/telephone-order) transactions;
- All processing of account data is entirely outsourced to PCI DSS compliant third-party service provider (TPSP)/payment processor;
- The merchant does not electronically store, process, or transmit any account data on merchant systems or premises, but relies entirely on a TPSP(s) to handle all these functions;
- The merchant has reviewed the PCI DSS Attestation of Compliance form(s) for its TPSP(s) and confirmed that TPSP(s) are PCI DSS compliant for the services being used by the merchant; and
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically.
Questions people ask
What is the difference between SAQ A and SAQ A-EP?
Ask: whose web page is the customer on when they type their card number? If it is your payment provider's page (a full redirect or fully hosted checkout), it is usually SAQ A. If it is your own page — even with the card fields supplied by the provider in an iframe — it is usually SAQ A-EP, because changes to your site could affect the security of that page.
Do I still need SAQ A if I use Shopify or Square?
Usually yes. Using a compliant provider reduces your work to SAQ A, but your bank or processor still expects you to complete and sign it each year.
Does SAQ A cover phone orders?
Only if your staff never handle the card number — for example, the customer pays through a link or an automated system run by your provider. If staff type card numbers into a virtual terminal, that is SAQ C-VT.
Other SAQ types
SAQ A-EP · SAQ B · SAQ B-IP · SAQ C · SAQ C-VT · SAQ P2PE · SAQ SPoC · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ A documentation published by the PCI Security Standards Council.