You process payments on your site and must comply with PCI DSS. Fines for card data breaches can reach millions of rubles, and Visa may disable your acquiring. We help online stores and services achieve certification in 5–30 days depending on the level. According to research, about 70% of companies choose SAQ A as the simplest compliance method, requiring 15 times fewer requirements than SAQ D — only 22 items vs. 300+. However, you need to properly configure the payment integration and infrastructure. With us, you avoid typical mistakes: storing CVV, weak SSL ciphers, lack of network segmentation. Below we break down how to ensure payment data protection and pass the audit without unnecessary costs.
Which PCI DSS Level Fits Your Website?
PCI DSS divides organizations into four levels based on transaction volume. The higher the level, the stricter the requirements.
| Level | Annual Transaction Volume | Mandatory Procedures |
|---|---|---|
| Level 1 | Over 6 million | Annual QSA audit + quarterly vulnerability scanning |
| Level 2 | 1–6 million | Annual SAQ + quarterly ASV scanning |
| Level 3 | 20 thousand – 1 million online | Annual SAQ |
| Level 4 | Under 20 thousand online | Annual SAQ |
Note: SAQ (Self-Assessment Questionnaire) — a self-assessment questionnaire. Its type depends on how card data is processed.
| Feature | SAQ A | SAQ D |
|---|---|---|
| Number of requirements | ~22 | 300+ |
| Card data processing | Only at provider side | On server |
| Implementation complexity | Low: 5–10 days | High: 3–6 months |
| Risk on error | Minimal | Critical |
The PCI Security Standards Council states: "PCI DSS is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment."
How to Protect Card Data Without Server-Side Processing?
The simplest path is to offload payment processing to a provider. Use Stripe Elements, Cloudpayments, or YooKassa with iframe. Then card data never reaches your server, and you can fill out SAQ A — only 22 items. Tokenization is 5 times cheaper than storing card data on your own server.
<div id="card-element"></div> <script src="https://js.stripe.com/v3/"></script> <script> const stripe = Stripe('pk_live_...'); const elements = stripe.elements(); const card = elements.create('card'); card.mount('#card-element'); const { paymentMethod } = await stripe.createPaymentMethod({ type: 'card', card: card, }); // Send paymentMethod.id to server — no card data </script> SAQ A requirements include: HTTPS on all pages, up-to-date SSL/TLS configuration (Requirement 4.1), prohibition of card data storage, quarterly ASV scanning, and a security policy.
How to Protect Data During Transmission and Storage?
If card data passes through your server (e.g., for recurring payments), SAQ D applies — over 300 items. We recommend avoiding this situation. Compare: migrating to tokenization reduces security costs by 5 times, and audit time from 3 months to 2 weeks.
Encryption in Transit (Requirement 4)
Use TLS 1.2 or 1.3 with strong ciphers. TLS 1.0 and 1.1 are no longer accepted.
ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers off; Data Storage (Requirement 3)
Store only the last 4 digits of PAN and BIN (first 6). Full PAN, CVV2, PIN, and magnetic stripe track are prohibited. PAN masking and truncation are required per PCI DSS version 3.2.1.
How We Ensure Compliance
We have completed over 50 projects bringing websites to PCI DSS compliance, with a proven track record of guaranteed certification. Typical scenario:
- Audit current state — determine level and gaps (e.g., missing network segmentation).
- Tokenization — migrate processing to iframe solution (Stripe, YooKassa).
- Security hardening — HTTPS, WAF, network segmentation (VLANs).
- ASV scanning — through an accredited vendor (quarterly).
- SAQ completion — help with questions and documentation.
Example case: an electronics online store with 300,000 orders per year. Initially — SAQ D, fines from Visa due to a breach. We implemented Stripe, configured SSL and WAF, moved to SAQ A. Security costs decreased by 5 times, audit time from 3 months to 2 weeks.
Work Process: From Audit to Certification
- Analysis — network, code, and configuration audit (including PCI DSS Requirement 11.3).
- Design — choose scheme (SAQ A vs D), migration plan.
- Implementation — configure HTTPS, tokenization, segmentation.
- Testing — ASV scanning, penetration test (Requirement 11.4).
- Documentation — policies, procedures, SAQ.
- Deployment — handover documentation to the bank.
What's Included (Deliverables)
- Detailed audit report with vulnerability identification.
- Configured HTTPS/TLS for all domains.
- Integrated payment system with tokenization.
- Completed SAQ with instructions.
- Regular ASV scanning (quarterly) via an approved scanning vendor.
- Information security policy for PCI DSS (Requirement 12).
- Consultations on request for 6 months after implementation.
Timelines and Cost
- SAQ A (tokenization + basic hardening) — from 5 to 10 business days. Typical project cost starts from 300,000 rubles, with clients saving up to 80% compared to full SAQ D audits.
- SAQ D (full scope) — from 3 to 6 months with QSA involvement. Cost is individually calculated.
- Contact us for a preliminary assessment of your project — we will prepare a commercial proposal. Order end-to-end PCI DSS implementation turnkey.
For common questions, see our FAQ below.