Compliance Assessment ToolSAQ C-VT: who needs it?
SAQ C-VT is for businesses that take card details over the phone or by mail and type them into a virtual terminal — a payment web page provided by your processor.
This is probably you if…
- Staff type card numbers into a virtual terminal in a web browser.
- They do it on one computer, in one location, kept apart from your other systems.
- That computer has no card reader attached and no software that saves card numbers.
Typical setups
- A florist taking phone orders and keying them into their processor's online virtual terminal.
- A service business entering card details from mailed-in order forms.
It's probably not SAQ C-VT if…
- Customers pay themselves through a link or hosted page — that is usually SAQ A.
- A card reader is plugged into the computer, or you save card numbers anywhere — that is usually SAQ C or SAQ D.
Not sure it's SAQ C-VT?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ C-VT, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ C-VT, the PCI Security Standards Council requires all of the following:
- The only payment processing is via a virtual payment terminal accessed by an Internet-connected web browser;
- The virtual payment terminal solution is provided and hosted by a PCI DSS compliant third-party service provider;
- The PCI DSS-compliant virtual payment terminal solution is only accessed via a computing device that is isolated in a single location, and is not connected to other locations or systems;
- The computing device does not have software installed that causes account data to be stored (for example, there is no software for batch processing or store-and-forward);
- The computing device does not have any attached hardware devices that are used to capture or store account data (for example, there are no card readers attached);
- The merchant does not otherwise receive, transmit, or store account data electronically through any channels (for example, via an internal network or the Internet); and
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically.
Questions people ask
Why isn't a virtual terminal SAQ A? The page is my processor's.
Because your staff's computer handles the card number while they type it. That computer is part of the payment flow, so it needs protecting — which is what SAQ C-VT covers.
Can we email card details to the person who keys them?
No — receiving card data electronically (email, chat, text) takes you out of SAQ C-VT. Take card details by phone or on paper only.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B · SAQ B-IP · SAQ C · SAQ P2PE · SAQ SPoC · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ C-VT documentation published by the PCI Security Standards Council.