PCI DSS

Also called Payment Card Industry Data Security Standard, PCI compliance, SAQ A

The card industry's security standard for any business that accepts, stores or transmits card data, which a studio selling through its own PSP has to validate every year.

Version 4.0.1 has been the only active version since PCI DSS v4.0 retired on 31 December 2024 (PCI SSC). A studio using a hosted or embedded checkout from Stripe or Adyen usually validates with the shortest form, SAQ A, and still has to complete it each year.

SAQ A changed on 31 March 2025. The PCI Security Standards Council removed two payment-page security requirements from the form and added an eligibility test: the merchant must confirm its site “is not susceptible to attacks from scripts that could affect the merchant’s e-commerce system(s)” (PCI SSC). A February 2025 PCI FAQ describes two ways to meet it. The studio can protect its own payment-page scripts, or get confirmation from its PSP that the embedded checkout includes script-attack protection.

A merchant of record takes the payment page out of the studio’s scope. FastSpring, for example, says it manages “global regulations, including GDPR and PCI DSS, on your behalf”. With a PSP, the annual self-assessment and the site-script controls stay with you. See build vs buy.