PCI Scope Reduction Checklist

Take card payments while keeping PCI down to a short self-assessment.

15 checks20 minutes

From the guide PCI Without the Pain: Taking Card Payments the Safe Way

PCI scope is set by one question: does a raw card number ever pass through systems you control. Answer no, and compliance stays light. Not legal advice.

01Choose the checkout

Confirm no raw card number ever reaches your serversIf card data passes through your systems, you must secure and prove every one of them.
Use a hosted checkout if you do not need a custom lookRedirecting to the processor's page is the least effort and the least scope.
Use processor-served embedded fields, such as Stripe Elements, for custom designThe digits go straight to the processor inside your design, at the same minimal scope.
Rule out a custom card form that posts the number to your backendA little styling freedom costs you the entire PCI burden.

PCI Scope Reduction Checklist

01Choose the checkout

02Handle tokens, never cards

03Lock down the page and keep it that way

The rest of the kit is one step away.