PCI SAQ types, explained.

A PCI SAQ, or Self-Assessment Questionnaire, is the form most merchants complete each year to show they meet the PCI Data Security Standard, and the type you use depends on how you accept cards. Setups where card data never touches your own systems use the shortest questionnaires, while setups that handle or store card data directly use the longest.

Here are the PCI SAQ types explained at a high level. The exact requirements in each questionnaire are set by the PCI Security Standards Council and change as the standard is updated, so always confirm current eligibility criteria with your processor before you choose. If you are new to PCI, start with what is PCI compliance.

The SAQ types at a glance

SAQ	Typical setup	Card data in your systems?
A	Online or phone orders fully outsourced, such as a hosted payment page or redirect	No
A-EP	E-commerce site that controls parts of the payment page, but card data goes straight to a third-party processor	No storage, but your site affects security
B	Imprint machines or standalone dial-out terminals	No electronic storage
B-IP	Standalone approved terminals connected to the processor over the internet	No electronic storage
C-VT	Card numbers keyed one at a time into a web-based virtual terminal	No electronic storage
C	Payment application or POS connected to the internet	No electronic storage
P2PE	Hardware terminals in a validated point-to-point encryption program	Encrypted at the device
D	Everything else, including merchants that store card data, and service providers	Often yes

Card-not-present setups: SAQ A and A-EP

SAQ A

SAQ A is for merchants that have fully outsourced card handling. A common example is an online store that sends customers to a hosted payment page or uses a payment form fully served by the gateway, so card numbers never pass through the merchant’s own website or servers. It also covers some phone and mail order setups where card data is entered only into a third party’s system. It is generally the shortest questionnaire.

SAQ A-EP

SAQ A-EP is for e-commerce merchants whose website controls part of the payment experience, even though card data is sent directly to a third-party processor. Because your website could be tampered with to capture card data, you have more to secure than under SAQ A. The difference between A and A-EP often comes down to how your checkout page is built, so ask your gateway or cart provider which applies.

Card-present setups: B, B-IP and P2PE

SAQ B covers merchants using only imprint machines or standalone terminals that connect by phone line, with no electronic card storage. SAQ B-IP covers standalone terminals approved under PCI device standards that connect to the processor over the internet, again with no storage. Both are for terminals that work on their own, not connected to a POS system or computer.

SAQ P2PE is for merchants using hardware terminals that are part of a validated point-to-point encryption program, listed by the PCI Security Standards Council. Card data is encrypted inside the device the moment the card is read, so it is unreadable as it travels through your environment. This can greatly reduce what you need to cover. A terminal that encrypts is not automatically eligible; the program must be validated. Our guide to tokenization and encryption explains the difference.

Keyed, POS and complex setups: C-VT, C and D

SAQ C-VT is for merchants who key card numbers, one transaction at a time, into a virtual terminal through a web browser on a computer used for that purpose, with no card storage. Phone-order businesses often fall here.

SAQ C covers merchants with a payment application or POS system connected to the internet, without electronic card storage. Many restaurants and retailers with integrated POS systems use it.

SAQ D is the catch-all. It applies to merchants who don’t fit any other type, including those who store card data electronically, and there is a separate version for service providers. It is the longest questionnaire by a wide margin. If you are on SAQ D, it is worth asking whether a change to your setup could move you to a shorter one.

How to pick the right SAQ

Work through these questions in order:

1. Do you store card numbers electronically anywhere? If yes, expect SAQ D.
2. Do you only take cards online or by phone through a fully outsourced provider? Look at SAQ A.
3. Does your website build or control part of the payment page? Look at SAQ A-EP.
4. Do you use only standalone terminals? Look at SAQ B or B-IP, depending on the connection.
5. Are your terminals part of a validated P2PE program? Look at SAQ P2PE.
6. Do you key cards into a virtual terminal? Look at SAQ C-VT.
7. Do you use a POS or payment software connected to the internet? Look at SAQ C.

Many businesses take cards more than one way. If you have a counter terminal and an online store, you may need to cover more than one setup, or a broader questionnaire. Confirm with your processor. Our PCI checklist for small business helps you get ready either way.

SAQ eligibility criteria and contents are set by the PCI Security Standards Council and are updated over time. This is a high-level overview, not a substitute for the current official documents or your processor’s guidance.

What PayZoom does

PayZoom offers PCI compliance help from a real person. We look at how you actually take cards, help you choose the right SAQ and walk through the questions with you. We also suggest setup changes, such as hosted payment pages, encrypted terminals or tokenization, that can reduce what you need to cover.

We never charge non-compliance fees. We help merchants stay compliant instead. PCI audits and PCI insurance are available when your business needs them. Call 866.242.4325 or start with a free statement analysis.