How PCI Booking affects your scope
PCI DSS applies to every system that stores, processes, or transmits cardholder data, even for a split second. PCI Booking reduces your scope by taking those functions out of your environment: cards are captured on PCI Booking hosted pages, stored in PCI Booking’s PCI DSS Level 1 certified environment, and delivered to payment gateways or third parties directly by PCI Booking. Your systems hold only tokens. The key principle: scope follows the card data. If every card in your business flows through PCI Booking and never touches your servers or your own page code, your environment holds no cardholder data and your compliance burden drops to the minimum for your entity type. If some flows still touch card data (an agent typing cards into your CRM, a partner sending you raw card numbers, a legacy import file), those flows keep you in scope regardless of how well the rest is integrated.Scope impact by integration method
Methods that keep card data out of your systems
Methods that expose your systems to card data
Which SAQ applies to you
This section assumes you have outsourced all card handling to PCI Booking, so card data never reaches your systems. Your acquirer has the final say on how you must validate compliance. If you are a technology provider (you handle card data on behalf of other businesses, for example a PMS, channel manager, booking engine or OTA), the relevant questionnaire is SAQ D for Service Providers. Most PCI Booking customers are in this group. You can complete and sign it yourself, using our Attestation of Compliance (AOC) and Shared Responsibility Matrix (SRM) to fill in the controls PCI Booking covers for you. See Compliance documents you can request. The controls left to you mostly concern your own policies, user management and page integrity. If you are the merchant (you accept payments for your own goods or services), you can typically comply with SAQ A, the shortest questionnaire. If card data does reach your systems, for example because you use Store a Card via Direct API or retrieve full card details, those systems are in scope and these shortcuts do not apply. The current SAQ forms are published in the PCI SSC document library. After opening the library, change the Filter by selection from “PCI DSS” to “SAQ” to list the questionnaires.Compliance documents you can request
PCI Booking is a PCI DSS Level 1 certified service provider (v4 compliant, certified annually). Three documents support your own compliance process, all available on request from support@pcibooking.net:- Attestation of Compliance (AoC) - certifies PCI Booking’s PCI DSS assessment, renewed annually.
- Shared Responsibility Matrix (SRM) - maps every PCI DSS v4.0.1 requirement to PCI Booking responsibility, client responsibility, or shared, with recommendations for the client-side controls. Use it alongside SAQ D to identify which controls PCI Booking covers for you.
- SAQ-D whitepaper - a QSA-authored companion document describing how outsourcing card handling to PCI Booking maps to the SAQ D for Service Providers.
If a third party asks about your compliance
If a PSP, acquirer, or partner asks about your (or PCI Booking’s) PCI DSS status for card data you route through PCI Booking, provide them with PCI Booking’s current AoC together with a statement along these lines:“We are outsourcing all raw card data handling to an integrator covered under this AoC certification.”Store the AoC and the SRM together as part of your compliance records.
Certification references: PCI DSS compliance, ISO 27001:2022, GDPR and data residency, PSD2.