PCI Scope and Compliance

​

How PCI Booking affects your scope

PCI DSS applies to every system that stores, processes, or transmits cardholder data, even for a split second. PCI Booking reduces your scope by taking those functions out of your environment: cards are captured on PCI Booking hosted pages, stored in PCI Booking’s PCI DSS Level 1 certified environment, and delivered to payment gateways or third parties directly by PCI Booking. Your systems hold only tokens. The key principle: scope follows the card data. If every card in your business flows through PCI Booking and never touches your servers or your own page code, your environment holds no cardholder data and your compliance burden drops to the minimum for your entity type. If some flows still touch card data (an agent typing cards into your CRM, a partner sending you raw card numbers, a legacy import file), those flows keep you in scope regardless of how well the rest is integrated.

​

Scope impact by integration method

​

Methods that keep card data out of your systems

​

Methods that expose your systems to card data

​

Which SAQ applies to you

Which Self-Assessment Questionnaire (SAQ) you fill out, and whether self-assessment is even sufficient, is determined by your acquirer, the card brands, and your transaction volume, not by PCI Booking. The typical outcomes: Merchants (you accept payments for your own goods or services):

• If card capture is fully hosted by PCI Booking (Hosted Card Entry Form, Card By Link) and no other flow touches card data, you are typically eligible for SAQ A, the shortest questionnaire.
• If your own page code participates in card entry, or you use server-side tokenization, expect SAQ A-EP or SAQ D for Merchants for those flows.

Service providers (you store, process, or transmit card data on behalf of other businesses - PMSs, channel managers, booking engines, OTAs):

• SAQ A and A-EP do not apply to service providers. The relevant instrument is SAQ D for Service Providers.
• If you integrated PCI Booking so that all card data stays inside PCI Booking, most SAQ D controls are covered by PCI Booking and documented as such in our Shared Responsibility Matrix. You self-attest the remaining controls, which mostly concern your own policies, user management, and page integrity.
• High-volume service providers (Level 1) may be required by card brands to complete a full Report on Compliance (ROC) with a QSA instead of self-assessing. Check your level with your acquirer.

The current SAQ forms are published in the PCI SSC document library. After opening the library, change the Filter by selection from “PCI DSS” to “SAQ” to list the questionnaires.

​

Compliance documents you can request

PCI Booking is a PCI DSS Level 1 certified service provider (v4 compliant, certified annually). Three documents support your own compliance process, all available on request from support@pcibooking.net:

• Attestation of Compliance (AoC) - certifies PCI Booking’s PCI DSS assessment, renewed annually.
• Shared Responsibility Matrix (SRM) - maps every PCI DSS v4.0.1 requirement to PCI Booking responsibility, client responsibility, or shared, with recommendations for the client-side controls. Use it alongside SAQ D to identify which controls PCI Booking covers for you.
• SAQ-D whitepaper - a QSA-authored companion document describing how outsourcing card handling to PCI Booking maps to the SAQ D for Service Providers.

​

If a third party asks about your compliance

If a PSP, acquirer, or partner asks about your (or PCI Booking’s) PCI DSS status for card data you route through PCI Booking, provide them with PCI Booking’s current AoC together with a statement along these lines:

“We are outsourcing all raw card data handling to an integrator covered under this AoC certification.”

Store the AoC and the SRM together as part of your compliance records.