PCI DSS SAQ Generator

SAQ A — Card-not-present, fully outsourced

All cardholder data functions outsourced to PCI DSS compliant providers. No electronic storage, processing, or transmission of CHD on your systems.

SAQ A-EP — Partially outsourced e-commerce

E-commerce merchant using a third-party payment page. Your website doesn't receive CHD but could affect payment page security.

SAQ B — Imprint machines / standalone dial-out terminals

Card imprint machines or standalone dial-out terminals not connected to internet or other systems.

SAQ C — Payment application systems connected to internet

Payment application systems connected to the internet. No electronic CHD storage.

SAQ D (Merchant) — All other merchants

All merchants not eligible for other SAQ types. Comprehensive assessment of all 12 PCI DSS requirements.

SAQ D (Service Provider) — Third-party service providers

Service providers that store, process, or transmit CHD on behalf of clients.