/
TSA Payments - PCI Compliance Guide

TSA Payments - PCI Compliance Guide

Quick summary

  • PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements designed to protect cardholder data.

  • TSA Payments uses an embedded secure checkout, so your business typically does not handle card numbers directly.

  • For merchants using TSA Payments embedded checkout only, PCI validation is typically: SAQ A (22 questions).

Do I still need PCI compliance if I use TSA Payments?

Yes. Even with an embedded checkout, merchants still have PCI responsibilities. The benefit of TSA Payments is that it’s designed to minimize your exposure to card data, which keeps your PCI validation simpler.

Which PCI form do I complete?

For most of our merchants we anticipate that SAQ A is the appropriate form. However, each merchant must make the determination for themselves based on their unique environment.

SAQ A is the generally accepted form when:

  • Customers enter card details only through the TSA Payments embedded payment form, and

  • You do not store, process, or transmit cardholder data on your own systems.

  • The merchant is responsible for accurately choosing the SAQ that matches how they accept/process payments (i.e., what systems touch card data).

  • A PCI Qualified Security Assessor (QSA) can be used to confirm the right category if there’s any ambiguity.

When your SAQ may be different

If your business does any of things listed below, the appropriate SAQ form might be different.

  • Ask customers to email/text card numbers

  • Store card numbers anywhere (spreadsheets, notes, CRM, tickets, screenshots, recordings, etc.)

  • Build your own card-entry fields outside the TSA Payments embedded form

  • Add other payment methods or manual-entry tools without reassessing PCI scope

If any of the above happens, your SAQ type may change and become more involved.

How to validate each year

  1. Complete SAQ A (most merchants using TSA Payments embedded checkout only).

  2. Save your SAQ + Attestation of Compliance (AOC) for your records.

  3. Provide proof if requested by TSA Payments based on your transaction volume.

Common questions

Do we need an outside audit?

Most merchants do not. Very high-volume merchants may have additional requirements.

What if a customer calls with a card number?

Do not write it down or store it. Only take payment using the approved TSA Payments checkout method.

Suggested Security Measures (simple checklist)

Even with embedded checkout, you’re responsible for keeping your systems safe.

Access control

  • Use strong passwords and enable MFA where available

  • Only give admin access to staff who need it

  • Remove access when roles change or staff leave

Device hygiene

  • Keep computers and browsers updated

  • Use antivirus/endpoint protection

  • Avoid using public/shared computers for payment administration

Website/app safety (important for embedded checkout)

  • Keep your website/CMS/plugins updated

  • Limit third-party scripts on checkout/payment pages (tracking, chat widgets, plugins)

  • Restrict who can edit website code or tags