PCI scope when you never touch the card number
Published Nov 5, 2026
If card numbers (the PAN) never touch your servers, because you use a processor's hosted payment page, redirect or hosted fields/iframes, your PCI DSS scope can shrink a lot, often toward the shortest self-assessment questionnaire. It never goes to zero: you still have to validate compliance every year, and your acquirer or QSA decides which form applies.
Key terms
- PAN (primary account number): the long card number. PCI DSS protects it, along with other cardholder and authentication data.
- PCI DSS: the Payment Card Industry Data Security Standard, published by the PCI Security Standards Council at pcisecuritystandards.org. Card brands and acquirers enforce it.
- SAQ (Self-Assessment Questionnaire): the form smaller merchants use to validate compliance. Which SAQ you use depends on how you accept cards.
- QSA (Qualified Security Assessor): a firm the PCI Council qualifies to assess compliance.
How the integration choice changes scope (conceptually)
| How you take the card online | Who touches the PAN | Typical SAQ family (confirm with your acquirer) |
|---|---|---|
| Full redirect or hosted payment page run by the processor | Processor only | SAQ A (shortest), if every requirement for it is met |
| Processor iframe / hosted fields embedded in your page | Processor only, but your page loads the form | Often SAQ A; your page scripts and site security still matter |
| Your page posts card data straight to the processor with its JavaScript (direct post) | Card data passes through code your site serves | Often SAQ A-EP (longer) |
| Card data hits your own servers | You | SAQ D or a full assessment (longest) |
In-store terminals, phone orders typed into a virtual terminal and point-to-point encryption devices have their own SAQ types. Read the current SAQ instructions on the PCI Council site; the exact eligibility rules are updated with each version of PCI DSS.
What still stays in scope
- The web pages and scripts that load or link to the payment form.
- Your staff, passwords and admin accounts for the store and gateway.
- Any paper or email where a customer sends you a card number: do not accept card numbers by email or text.
- Phone orders, unless your processor gives you a method that keeps the number off your systems.
What Bullion Price Check does and does not do
We do not certify, assess or attest PCI compliance for anyone, and nothing on this site is a PCI attestation. We never see or store card numbers. Talk to your acquirer and a QSA.
Related dealer tools
- Card and wire payments for bullion dealers (hub)
- Card vs ACH vs wire vs cash: the true cost for bullion dealers
- Remote bullion sale checklist: AVS, CVV, 3-D Secure and liability shift
- Chargeback risk on high-ticket bullion orders
- Payment processor directory for bullion dealers
- True cost calculator: delivered totals by dealer, card vs bank payment
- Developer and dealer quickstart
- List your shop or partner with Bullion Price Check
FAQ
If I use hosted fields, am I PCI compliant?
Not automatically. Your scope can be smaller, but you still validate compliance each year with the form your acquirer requires.
Does Bullion Price Check certify PCI compliance?
No. We do not assess or certify anyone.