PCI Compliant Payment Gateways: What the Gateway Covers and What Stays Yours

A PCI compliant payment gateway has proven that its own systems meet the card industry's security standard. That's useful, but it answers only half the question. The other half is what stays on your side: your checkout pages, your questionnaire, your merchant level and the evidence your acquirer asks for every year.

What "PCI compliant payment gateway" actually means

PCI DSS is the security standard published by the PCI Security Standards Council, founded by the card networks. The current version is PCI DSS v4.0.1, published in June 2024: it added no requirements, and since December 31, 2024 it's the only version in force.8PCI Security Standards Council blog, Just published: PCI DSS v4.0.1, June 11, 2024

A gateway handles card data for other businesses, so PCI DSS treats it as a service provider, not a merchant. (If the line between gateway and processor is blurry, see payment gateway vs payment processor.) Mastercard's rules put every merchant payment gateway in Level 1, whatever its volume. A Level 1 service provider validates every year through a Report on Compliance (ROC) written by a Qualified Security Assessor (QSA).11Mastercard, Security Rules and Procedures, Merchant Edition, August 4, 2026

The standard is organized in 12 requirements, from network security controls to an information security policy.5PCI Security Standards Council, Self-Assessment Questionnaire D for Merchants, PCI DSS v4.0, April 2022 A Level 1 gateway is assessed against all of those that apply to its environment. What it doesn't cover is the part of the payment that runs on your side.

TPSP means third-party service provider: your gateway, your processor, your hosting company if it can affect card data.1PCI Security Standards Council, Self-Assessment Questionnaire A for PCI DSS v4.0, April 2022 Stripe puts it the same way: it's certified as a Level 1 service provider, and you must accept payments in a compliant manner and attest to it every year.13Stripe Docs, Integration security guide

How to check that a gateway is PCI compliant

A "PCI compliant" badge on a pricing page proves nothing. PCI DSS itself says a declaration on a company's website isn't the same as a written agreement.1PCI Security Standards Council, Self-Assessment Questionnaire A for PCI DSS v4.0, April 2022 Visa requires issuers and acquirers to make sure all their service providers demonstrate PCI DSS compliance at least every 12 months.10Visa, Account Information Security (AIS) Program and PCI Do the same on your side with four checks.

Read the registry carefully. Not every listing is a PCI DSS validation.

One more rule from Visa: if you pick a service provider from the registry, you must tell your acquiring bank before you use it, so the acquirer registers it.9Visa, Global Registry of Service Providers

The gateway's job and yours

PCI DSS asks you to keep a list of every provider that touches card data, a written agreement with each, a due diligence process before signing, and a check of their compliance status at least once every 12 months.1PCI Security Standards Council, Self-Assessment Questionnaire A for PCI DSS v4.0, April 2022 Here's how the work usually splits with a hosted or embedded gateway.

Sources: PCI SSC SAQ A requirements 3, 8, 12.8 and 12.10; Stripe integration security guide.1PCI Security Standards Council, Self-Assessment Questionnaire A for PCI DSS v4.0, April 202213Stripe Docs, Integration security guide

Which SAQ you file depends on your integration

This is what "PCI compliance for a payment gateway" means from the merchant side. How your checkout hands the card to the gateway decides which self-assessment questionnaire (SAQ) fits. The PCI SSC doesn't set your validation duties itself: your acquirer and the card brands do, so confirm the questionnaire with them.2PCI Security Standards Council blog, Important updates announced for merchants validating to Self-Assessment Questionnaire A, January 30, 2025

That second option is a gateway selection question: ask for the written confirmation before you sign. The detailed choice between a redirect, an iframe and your own form is in our guide to hosted payment gateways, and the build steps in how to integrate a payment gateway.

The gap between questionnaires is large. Stripe says a business that takes untokenized card numbers on its own payment page may have to meet more than 300 security controls.13Stripe Docs, Integration security guide The forms show it too:

PCI merchant levels: how you validate

Your merchant level is set by your yearly card transaction volume, and it decides how you prove compliance. Here are Mastercard's levels, which also count any merchant that meets Visa's criteria for a level.11Mastercard, Security Rules and Procedures, Merchant Edition, August 4, 2026

Three details matter for a growing brand:

• Moving up a level gives you up to one year to meet the new level's requirements.11Mastercard, Security Rules and Procedures, Merchant Edition, August 4, 2026
• A confirmed data compromise can move any merchant to Level 1, with a full assessment.11Mastercard, Security Rules and Procedures, Merchant Edition, August 4, 2026
• Your acquirer is the one asking. Mastercard makes acquirers report Level 1 and Level 2 merchants twice a year, and the PCI SSC leaves validation rules to the acquirers and brands.11Mastercard, Security Rules and Procedures, Merchant Edition, August 4, 20262PCI Security Standards Council blog, Important updates announced for merchants validating to Self-Assessment Questionnaire A, January 30, 2025

Don't confuse your merchant level with your gateway's service provider level. "Level 1" on a gateway's website is about the gateway, not about you.

Inside Tagada

See every payment's route, processor by processor

Set the order your processors are tried in, per store, per country or per product.

See how routing works

Tokenization, encryption and P2PE: what they change for your scope

A compliant gateway reduces your PCI compliance scope mainly through tokenization: the card number goes into the gateway's vault and you keep a token. The PCI SSC's guidance sets the limits.7PCI Security Standards Council, Information Supplement: PCI DSS Tokenization Guidelines, August 2011

• Tokenization doesn't remove PCI DSS. The PCI SSC says tokenization solutions "do not eliminate the need to maintain and validate PCI DSS compliance", but they can simplify it.7PCI Security Standards Council, Information Supplement: PCI DSS Tokenization Guidelines, August 2011
• If you can get the card number back, you're in scope. The guidelines say that if the PAN is retrievable by the merchant, the merchant's environment is in scope.7PCI Security Standards Council, Information Supplement: PCI DSS Tokenization Guidelines, August 2011
• Some card data never stays anywhere. Stripe notes that card type, last four digits and expiry date are out of PCI scope and can be stored.13Stripe Docs, Integration security guide The security code and other sensitive authentication data must not be kept after authorization.5PCI Security Standards Council, Self-Assessment Questionnaire D for Merchants, PCI DSS v4.0, April 2022
• P2PE is for card terminals. A point-to-point encryption solution listed by the PCI SSC shrinks scope in stores and for phone orders keyed into its terminals. SAQ P2PE doesn't apply to e-commerce.6PCI Security Standards Council, Self-Assessment Questionnaire P2PE for PCI DSS v4.0, April 2022

The difference between a token and an encrypted card number, and which tokens can move to another processor, is in tokenization vs encryption.

How to choose a gateway on PCI grounds

Every serious gateway is Level 1. The differences that matter are in what it lets you avoid and what it lets you take with you.

Card data export deserves a second look. Stripe transfers card data only to a processor that shows a current AOC or a listing on Visa's registry, and it doesn't export payment history, subscriptions or cards saved with Link.14Stripe Docs, Request a payment data export If you run subscriptions, that export path is what keeps renewals running after a switch.

What happens if you're not compliant

PCI DSS isn't a law. It's enforced through the card networks' rules and your merchant agreement, and the consequences are real.

Mastercard levies these assessments on its customers, the acquirers. Level 3 merchants face up to $10,000 for a first violation and up to $80,000 for a fourth. Noncompliance can also lead to the merchant's termination.11Mastercard, Security Rules and Procedures, Merchant Edition, August 4, 2026 A termination for PCI DSS noncompliance is a MATCH list reason (code 12), which can be removed once you're compliant again.15Stripe Docs, Terminated merchant files (MATCH and VMSS) Whether an assessment passes on to you depends on your merchant agreement.

Common mistakes

Payment page skimming is the web version of card skimming: a script on the page copies the card number as it's typed. That's why PCI DSS v4 put so much weight on the scripts around the payment form, and why the cleanest checkout is also the easiest one to validate. More on the other risks that sit around payments in payment risk management.

Where Tagada fits

Whichever provider you pick, Tagada included, run the same checks: the Visa and Mastercard listings, the AOC and the services it covers, the questionnaire your checkout puts you on, and the way out for your card data.