PCI DSS Payment Card Industry compliance on the BazPay gateway.
The Payment Card Industry Data Security Standard defines the controls every entity that touches cardholder data must meet. BazPay is a PCI DSS Level 1 payment gateway, assessed each year. Hosted fields and gateway-side vaulting keep raw card data out of your stack — so most integrations qualify for merchant SAQ A, the smallest possible scope on the merchant side.
Built for merchants across the EU, UK, Australia, Canada and New Zealand: e-commerce sellers, subscription software firms and professional-services businesses. Compliance evidence is a document exchange, not a discovery exercise.
Why merchants pick a PCI DSS Level 1 gateway
PCI DSS compliance scales with the size of the cardholder-data environment you have to defend. Four benefits make hosted fields and a Level 1 provider the shortest path to a small, defensible scope.
-
Scope reduction is the whole point
PCI DSS scales with what card data you touch. Hosted fields and gateway-side vaulting mean your servers never see raw PAN, so the assessed environment on your side shrinks to the smallest merchant scope — SAQ A. Less scope means less to build, less to audit and less that can go wrong.
-
Level 1 provider, annual assessment
BazPay's acquiring and gateway environment is assessed each year against the Payment Card Industry Data Security Standard at Level 1 — the highest provider tier. The merchant-side compliance you inherit is a first-class reason to sit behind that boundary.
-
Network tokens replace stored PAN
Card-on-file storage uses Visa and Mastercard network tokens, refreshed automatically on reissue. That removes the classic "stored credential" PCI risk without removing the ability to bill recurring charges.
-
Evidence, not marketing
Compliance conversations end on evidence, not on brochures. Signed webhooks, audit-logged dashboard actions, a versioned API contract and hosted-fields architecture make the review a document exchange, not a discovery exercise.
The merchant scope spectrum, from SAQ A to SAQ D
The Payment Card Industry Data Security Standards define several Self-Assessment Questionnaires depending on how card data touches your systems. BazPay is designed so that most integrations land at SAQ A — the smallest merchant scope.
-
SAQ A
SAQ A — hosted or fully outsourced
You do not store, process or transmit cardholder data on your systems. Card entry happens inside the provider's PCI environment — hosted fields, iframes or redirects. The smallest merchant scope, and the one most BazPay integrations qualify for.
- Hosted fields
- Iframe capture
- Full redirect
-
SAQ A-EP
SAQ A-EP — merchant controls the checkout page
Your servers deliver the checkout page but card entry still goes to the provider directly. Larger scope than SAQ A because of the page-integrity requirements on your side.
- Merchant-hosted page
- Provider-hosted capture
-
SAQ D
SAQ D — merchant handles PAN
Cardholder data flows through your servers or is stored on them. Largest merchant scope, longest audit, and where you end up if you take PAN into your own POST body without a hosted-fields alternative.
- Full merchant PCI
- PAN through your servers
-
Service providers
Provider Level 1 — where BazPay sits
The provider tier BazPay is assessed against for its acquiring and gateway environment. Level 1 is the strictest tier, with the widest sample of controls, evidence and testing.
- Provider tier
- Annual assessment
Broader security architecture on secure online payment systems. The engineering foundation on payment infrastructure.
How a PCI DSS payment moves through your integration
Six stages describe how a card charge crosses the PCI boundary — from the hosted field that captures the PAN to the network token that persists it. The merchant SAQ A boundary sits at stage three.
-
Serve the field
The hosted field iframe loads over TLS from BazPay's PCI environment. Your page hosts a container div; the field itself is rendered by the provider.
-
Collect the PAN
The shopper types their card number inside the iframe. The value never enters your DOM, form state or logs.
-
Tokenise
BazPay returns a one-time payment token to your client. Your server sees the token, not the PAN. This is the SAQ A boundary.
-
Charge
Your server posts the charge request with the token to BazPay's REST API. The idempotency header makes retries safe.
-
Store for reuse
For card-on-file, BazPay issues a persistent vault token and, where the network supports it, a Visa or Mastercard network token.
-
Renew safely
Network tokens refresh automatically after an issuer reissue. Your database keeps the same token — the PAN under it moves without your intervention.
Hosted fields vs merchant-hosted PAN capture
The single largest determinant of your PCI scope is whether raw PAN passes through your servers. The comparison below shows the two approaches side by side.
| Dimension | BazPay hosted fields | Merchant-hosted PAN capture |
|---|---|---|
| PAN on your servers | No — hosted fields | Yes — POST through your form |
| Merchant SAQ target | SAQ A | SAQ D |
| Provider certification | PCI DSS Level 1 | Depends on vendor |
| Vault ownership | Provider-side vault + network tokens | Merchant vault or self-hosted |
| Refresh on reissue | Automatic via network token services | Manual PAN update required |
| Audit surface on your side | Small; SAQ A questionnaire | Large; on-site RoC or SAQ D |
Rate structure on the pricing page. Storefront plugins on integrations. Ongoing operational envelope on gateway services.
Primitives that shrink your PCI DSS scope
Every capability below ships on the standard integration. None of them is a premium tier — the PCI-scope-reducing primitives are how BazPay is designed to be used.
-
Hosted fields
Card, expiry and CVC inputs served from BazPay's PCI environment inside your own checkout. Raw PAN never enters your stack.
-
Hosted checkout page
Prebuilt redirect surface for teams that prefer full outsourcing. Widest applicability of SAQ A, no front-end integration on your side.
-
Gateway-side vault
Stored credentials live in BazPay's PCI Level 1 scope, keyed to your merchant, portable if you ever migrate infrastructure.
-
Network tokens
Visa and Mastercard network tokens replace PAN at storage time and refresh automatically after issuer reissue.
-
TLS transport
TLS on every API request, every webhook delivery and every hosted-fields render — modern cipher suites, no legacy fallback.
-
Signed webhooks
HMAC-signed, replay-protected events on every state change. Verify once, trust the payload.
-
Audit-logged dashboard
User actions, key rotations, rule changes and payout schedule edits recorded with actor, timestamp and diff — evidence for a compliance review.
-
Versioned API
Every API request carries a version header; breaking changes ship on the next major with a documented deprecation window.
A PCI DSS payment application in a few lines
The hosted-field container sits in your checkout. The provider serves the actual input fields. On submit, you receive a token; your server posts that token to the REST API with an amount and currency. The PAN never leaves BazPay's PCI environment.
<div id="bp-card"></div>
<script src="https://js.bazpay.com/v1/checkout.js"></script>
<script>
const bp = BazPay('pk_live_...');
bp.mountCard('#xb8a-o09d', { onToken: submitCharge });
</script>POST /v1/charges
Idempotency-Key: 8f1c-2b3a-9e4d
{
"amount": 4990,
"currency": "EUR",
"payment_method": "card",
"source_token": "tok_9C21...",
"three_d_secure": "required_if_needed"
}Full schema in the API reference. Fraud-scoring context on payment fraud prevention.
Who uses BazPay for PCI-friendly card acceptance
The four merchant profiles below already rely on the PCI DSS Level 1 gateway when their own security teams or enterprise buyers ask for evidence.
-
E-commerce sellers
DTC brands running regional storefronts on Shopware, Magento 2, WooCommerce or PrestaShop. Hosted fields keep the annual return at merchant SAQ A regardless of shop volume.
-
Subscription software
SaaS teams whose enterprise buyers ask for PCI evidence during the security review. Network tokens keep card-on-file renewals PCI-safe.
-
Professional services
Consultancies invoicing higher-ticket amounts. Redirect to a hosted checkout page or use hosted fields inside your own portal — both keep scope small.
-
Digital publishers
Membership and paywall businesses whose finance teams do not want a PCI environment to maintain alongside the CMS.
Out of scope for BazPay: adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection and MLM. BazPay is not a merchant of record and not a card issuer.
Adjacent compliance signals
PCI DSS is one of several controls a merchant's compliance team will ask about. The others — PSD2, GDPR, scheme registrations — all sit alongside on the BazPay platform, not layered on top of it. A single vendor security review typically covers them together.
- PCI DSS Level 1
- Annual assessment on the acquiring and gateway environment
- Merchant SAQ A
- Hosted fields and gateway vault keep card data out of your stack
- Authentication
- 3-D Secure 2.2 with automatic exemption logic on every card charge
- GDPR
- In-region data residency; DPA on request
- Scheme registrations
- Visa VIRP and Mastercard SPoC/PCI-CP where required
Questions merchants ask about PCI DSS
What is PCI DSS, and why does it matter to a merchant?
PCI DSS — the Payment Card Industry Data Security Standard — is the compliance standard the card schemes require of every entity that stores, processes or transmits cardholder data. It is issued and maintained by the PCI Security Standards Council. Any merchant that takes card payments is in scope for some level of PCI DSS compliance; how much scope depends on how card data flows through your systems.
What is BazPay's status against the Payment Card Industry Data Security Standard PCI DSS compliance?
BazPay's acquiring and gateway environment is assessed against PCI DSS at Level 1 on an annual cadence. Level 1 is the strictest tier for service providers. Merchant scope on the other side of a BazPay integration is typically SAQ A — the smallest questionnaire — because hosted fields and gateway-side vaulting keep raw PAN out of the merchant's environment.
Do I need to be PCI compliant if I use a PCI DSS payment gateway?
Yes — any merchant taking card payments needs its own PCI compliance posture, even when the gateway is Level 1 certified. The gain from using a PCI DSS Level 1 provider is scope reduction: your annual return shrinks from a full RoC or SAQ D to SAQ A because the provider handles the cardholder-data environment.
Can BazPay provide us with an Attestation of Compliance?
Yes. BazPay provides its current Attestation of Compliance to boarded merchants on request. Requesting the AoC is a standard part of the boarding review; your compliance team receives it as the evidence artefact for any vendor risk assessment or PCI RoC that references BazPay as the PCI DSS payment gateway.
What does a PCI DSS payment solution actually look like on my stack?
In practice: a hosted-fields snippet inside your checkout, a token returned to your server, a REST call to create a charge with that token, and a signed webhook that confirms the outcome. Your codebase never sees a card number. That is the PCI DSS payment application shape that keeps merchant SAQ A intact.
How does PCI DSS compliance interact with GDPR and PSD2 for the same merchant?
The three sit alongside each other, not on top of each other. PCI DSS covers cardholder data specifically. GDPR covers personal data of local shoppers regardless of payment method. Open-finance regulation governs strong customer authentication and payment services in-region. BazPay's platform covers the payment-side controls for all three — PCI DSS on the cardholder-data environment, GDPR on In-region data residency, authentication through 3-D Secure 2.2.
What about newer PCI DSS versions and requirement changes?
The Payment Card Industry Data Security Standards evolve with the schemes; the PCI Security Standards Council publishes each new version with transition windows. BazPay's assessment is renewed on a rolling annual cadence and aligned to the version in force at the time of audit. Merchants inherit the benefit of that alignment through the scope-reduction the hosted-fields architecture provides.
Which merchant types can board on this PCI-DSS-scoped platform?
Merchants across the EU, UK, Australia, Canada and New Zealand: e-commerce sellers, subscription software firms, professional-services businesses and digital publishers. BazPay does not board adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants, and does not act as a merchant of record or a card issuer.
Shrink your PCI DSS scope with a Level 1 gateway
Share your existing card-flow architecture; a named engineer will map the SAQ A path and confirm boarding fit inside one working day. See also gateway services, payment infrastructure and pricing.