# What is PCI compliance?

Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements created and enforced by the major card networks including Visa, Mastercard, American Express, Discover, and JCB to protect cardholder data globally.
If your business accepts, processes, stores, or transmits credit or debit card information in any way, PCI DSS applies to you. This is true regardless of size, business model, or transaction volume.
PCI DSS is not a law, but it is a regulatory requirement and card networks can enforce fines for non-compliance. It protects your customers' payment data from theft and your business from the financial and reputational consequences of a breach.
## What are the consequences of non-compliance?
Non-compliance can result in:
- Fines from Visa/Mastercard
- Increased liability if a data breach occurs while you are out of compliance
- Potential account restrictions or BIN Sponsor-driven offboarding of the account
Compliance also provides a practical security benefit: it protects your customers' data and reduces the risk of fraud losses to your business.
## Is Stripe PCI compliant?
Stripe is a PCI Level 1 Service Provider - the highest certification available. Stripe undergoes an annual audit by an independent QSA and is listed in [Visa's service provider registry](https://www.visa.com/splisting/searchGrsp.do?companyNameCriteria=stripe).
Stripe simplifies your path to PCI compliance, but Stripe doesn't make you PCI compliant by default.
## What does Stripe handle?
- Securely capturing, encrypting, and tokenizing card data so it never touches your servers (when using Stripe's hosted tools)
- Maintaining a compliant environment for storing and processing card data
- Qualifying you for a reduced PCI SAQ, shrinking your compliance scope based on your eligibility/integration
## What doesn't Stripe handle?
- Your PCI obligations in full. You remain responsible for your own environment
- PCI questionnaires or audits on your behalf
- ASV (Approved Scanning Vendor) scanning for your systems
Download Stripe's AoC, Shared Responsibility Matrix, and SOC reports directly from [your dashboard](https://dashboard.stripe.com/settings/compliance/documents).
### PCI Levels (by annual transaction volume)
- Compliance level
- Applies to
- Requirements
---
- Level 1
- Organisations that annually process more than 6 million transactions of Visa or Mastercard, or more than 2.5 million for American Express; or have experienced a data breach; or are deemed "Level 1" by any card association (Visa, Mastercard, etc.)
- Attestation of Compliance ([AOC](https://www.pcisecuritystandards.org/document_library)) or annual Report on Compliance ([ROC](https://www.pcisecuritystandards.org/document_library/)) by a Qualified Security Assessor ([QSA](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors)) or merchant's executive officer. Quarterly network scan by an Approved Scanning Vendor ([ASV](https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors)).
---
- Level 2
- Organizations that process between 1–6 million transactions annually
- Self-Assessment Questionnaire ([SAQ](https://www.pcisecuritystandards.org/document_library/?category=saqs#results)), or Attestation of Compliance ([AOC](https://www.pcisecuritystandards.org/document_library)), or Report on Compliance ([ROC](https://www.pcisecuritystandards.org/document_library/)). SAQ A, SAQ A-EP, and SAQ D documentation must be signed by a PCI Qualified Security Assessor ([QSA](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors)) or a PCI-Certified Internal Security Assessor ([ISA](https://www.pcisecuritystandards.org/assessors_and_solutions/become_isa/)). Quarterly network scan by an Approved Scanning Vendor ([ASV](https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors)).
---
- Level 3
- Organizations that process between 20,000–1 million online transactions annually; or organizations that process fewer than 1 million total transactions annually
- Level 3 users are automatically enrolled in our Risk Management Program, which provides a customized and simplified experience based on various factors, including integration type. This may include completing one or more PCI DSS [Self-Assessment Questionnaires (SAQs)](https://www.pcisecuritystandards.org/document_library/?category=saqs#results). Level 3 users must also complete quarterly network scans by an Approved Scanning Vendor ([ASV](https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors)).
---
- Level 4
- Organizations that process fewer than 20,000 online transactions annually; or organizations that process up to 1 million total transactions annually
- Level 4 users are automatically enrolled in our Risk Management Program, which provides a customized and simplified experience based on various factors, including integration type. This may include completing one or more PCI DSS [Self-Assessment Questionnaires (SAQs)](https://www.pcisecuritystandards.org/document_library/?category=saqs#results). Level 4 users must also complete quarterly network scans by an Approved Scanning Vendor ([ASV](https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors)).
### SAQ types by integration (Levels 2 through 4 only)
- Integration
- SAQ
- What it means
---
- Checkout, Elements (v3), Connect, Mobile SDK
- SAQ A
- Card data never touches your server; Stripe pre-fills most of this form
---
- Stripe.js v2 (form on your own site)
- SAQ A-EP
- Your site is partially in scope
---
- Manual card entry via Stripe Dashboard
- SAQ C-VT
- For rare, exceptional use only — not routine processing
---
- Stripe Terminal
- SAQ C or SAQ P2PE
- Depends on reader configuration
---
- Raw card numbers sent directly to Stripe API
- SAQ D
- Your full server environment is in scope — the most demanding requirement
Using Stripe Elements, Checkout, or a mobile SDK qualifies you for SAQ A, the lowest-burden option. Switching from a direct API integration (SAQ D) to these tools removes your servers from PCI scope entirely and also unlocks Stripe Radar.
### MOTO (Mail Order/Telephone Order) Payments
Stripe enables businesses to accept MOTO payments securely by integrating with third-party services that automate card detail collection via touch-tone or voice recognition. This eliminates manual transcription and minimizes PCI compliance requirements by removing humans from the process.
Depending on the implementation, there are three primary SAQ outcomes:
- SAQ Type
- Use Case Description
- Key Requirements & Restrictions
---
- SAQ-A
- Card data is collected via a PCI-compliant third-party solution and routed directly to Stripe.
- The user must not have access to card data during the call and cannot store, process, or transmit it.
---
- SAQ C-VT
- User receives card data and manually enters it directly into the Stripe Dashboard.
- Restricted to limited, non-recurring use cases. Electronic storage of card information is strictly prohibited.
---
- SAQ-D
- User collects cardholder data directly from the customer.
- Applies when cardholder data is electronically stored within the user's environment.
Businesses should consult a PCI Qualified Security Assessor (QSA) for specific implementation guidance.