PCI DSS Compliance for SaaS Companies: A Practical Guide for SMBs
SaaS companies that store, process, or transmit cardholder data must comply with PCI DSS. Your required compliance level depends on annual transaction volume. Most SMB SaaS companies qualify as SAQ-eligible merchants, which reduces audit burden significantly compared to full Report on Compliance (ROC) requirements.
PCI DSS (Payment Card Industry Data Security Standard) applies to any SaaS company that touches payment card data - whether you process payments directly, pass card data through your platform, or store tokens on behalf of customers. The standard is maintained by the PCI Security Standards Council and enforced by card brands including Visa, Mastercard, American Express, and Discover.
For SMB SaaS companies, the compliance path is often more manageable than it appears. Companies processing fewer than 1 million Visa or Mastercard transactions annually typically qualify as Level 3 or Level 4 merchants, which allows them to complete a Self-Assessment Questionnaire (SAQ) rather than undergoing a full qualified security assessor (QSA) audit. However, the specific SAQ type - A, A-EP, B, C, D - depends on how your SaaS platform handles card data.
The most common mistake SMB SaaS companies make is assuming that using a third-party payment processor like Stripe or Braintree automatically makes them compliant. Tokenization and outsourced payment pages reduce your scope, but they do not eliminate your PCI DSS obligations. You still need to document your controls, complete the appropriate SAQ, and obtain an Attestation of Compliance (AOC) if required by your acquiring bank or enterprise customers.
What Are the PCI DSS Requirements That Apply to SaaS Companies?
PCI DSS v4.0, released in March 2022 and mandatory as of March 31, 2024, is organized around 12 core requirements grouped into six control objectives. For SaaS companies, the requirements most directly relevant to your architecture and risk surface are the following.
**Requirement 1 and 2 - Network Security Controls**: You must define and document your cardholder data environment (CDE), segment it from the rest of your network, and maintain secure configurations on all in-scope systems. For SaaS companies hosted on AWS, GCP, or Azure, this means understanding which cloud services are in-scope and how your shared responsibility model affects your obligations.
**Requirement 3 - Protect Stored Account Data**: If your SaaS platform stores primary account numbers (PANs), you must encrypt them using strong cryptography such as AES-256. Most SMB SaaS companies avoid storing raw PANs entirely by using tokenization through their payment processor, which dramatically reduces scope under Requirements 3 and 4.
**Requirement 6 - Secure Systems and Software**: SaaS platforms must maintain a secure software development lifecycle (SSDLC), conduct code reviews, and test for common vulnerabilities including those listed in the OWASP Top 10. PCI DSS v4.0 introduces more explicit requirements around web application firewalls (WAF) and change detection for payment pages.
**Requirement 8 - Identity and Access Management**: Multi-factor authentication (MFA) is now mandatory for all access into the CDE under PCI DSS v4.0, not just remote access. This applies to your internal admin panels, cloud consoles, and any system that touches card data.
**Requirement 11 - Testing Security Systems**: Quarterly vulnerability scans by an Approved Scanning Vendor (ASV) and annual penetration testing are required for most merchant levels. SaaS companies with externally facing systems should budget for these as recurring line items.
**Requirement 12 - Support Information Security with Organizational Policies**: You need a written information security policy, a risk assessment process, and documented incident response procedures. For companies with 20-100 employees, this often means formalizing practices that exist informally.
Understanding exactly which requirements apply to your SaaS architecture requires scoping your CDE accurately. A QSA or compliance tool can help you map your data flows before committing to a specific SAQ type.
Which SAQ Type Is Right for a SaaS Company?
The Self-Assessment Questionnaire you complete determines the scope of your compliance effort. Choosing the wrong SAQ - either understating or overstating your scope - creates legal and financial risk. Here is how the most relevant SAQ types apply to common SaaS payment architectures.
**SAQ A**: This is the simplest option. It applies when your SaaS platform redirects customers entirely to a third-party payment page (such as Stripe Checkout or PayPal), your system never sees the card number, and you have no electronic storage of cardholder data. SAQ A has 22 requirements and is the most common choice for SaaS companies with a redirect-based checkout. However, if your platform uses embedded iframes or JavaScript-based payment forms, you may not qualify for SAQ A under PCI DSS v4.0.
**SAQ A-EP**: This applies to SaaS companies that use a third-party payment processor but host their own payment page - for example, a custom checkout form that passes card data via a JavaScript SDK without the card data ever touching your servers. SAQ A-EP has 191 requirements and includes web application security testing obligations. PCI DSS v4.0 added script integrity requirements that directly affect this architecture.
**SAQ C**: This applies when your SaaS platform has a payment application system connected to the internet but does not store cardholder data electronically. It has 160 requirements and is common for SaaS platforms with point-of-sale or API-based transaction flows.
**SAQ D for Merchants**: If your SaaS platform stores, processes, or transmits cardholder data in a way that does not fit A, A-EP, B, or C, you default to SAQ D, which covers all 12 PCI DSS requirement domains and has over 300 individual controls. This is the most burdensome path and is common for SaaS platforms that serve as a payment facilitator or marketplace.
For SaaS companies unsure of their SAQ type, the PCI SSC provides a guidance document titled 'Information Supplement: Choosing the Correct SAQ' available at pcisecuritystandards.org. Alternatively, your acquiring bank can provide guidance, and some QSAs offer scoping workshops for a flat fee before a full engagement begins.
The key business decision is reducing your CDE scope before you begin your assessment, not after. Architectural changes - such as switching from a hosted form to a redirect - can move you from SAQ D to SAQ A, reducing your compliance workload by more than 80 percent.
How Much Does PCI DSS Compliance Cost for a SaaS Company?
Compliance costs vary significantly based on your SAQ type, current security posture, and whether you use internal resources or external vendors. The following cost ranges are based on publicly available QSA fee data and industry surveys as of 2024.
**SAQ Completion**: For Level 3 and Level 4 merchants completing SAQ A or SAQ A-EP without outside help, the cost is primarily internal labor - typically 8 to 40 hours depending on documentation maturity. Compliance software platforms can reduce this to 4 to 12 hours by automating evidence collection.
**QSA Consultation or Assessment**: A scoping workshop with a QSA typically costs between $2,500 and $8,000 for SMBs. A full QSA-led SAQ D assessment can range from $15,000 to $50,000 or more depending on complexity. Report on Compliance (ROC) engagements for Level 1 merchants start at $50,000 and can exceed $200,000 for complex SaaS environments.
**ASV Scanning**: Approved Scanning Vendor quarterly scans for external-facing IPs typically cost between $100 and $500 per quarter for SMBs, depending on the number of IPs in scope. Several vendors offer annual subscription pricing starting around $400 per year for small scan footprints.
**Penetration Testing**: Annual penetration tests required under Requirement 11.4 cost between $4,000 and $20,000 for SMB SaaS environments, depending on scope and methodology. Network-only tests cost less than full application-plus-network tests.
**Remediation**: If your current environment has gaps - missing MFA, unpatched systems, undocumented policies - remediation costs vary widely. Companies with no prior security program should budget $10,000 to $30,000 for initial gap closure. Companies with existing security tooling typically spend $2,000 to $8,000 on targeted remediation.
**Ongoing Compliance Management**: Annual recurring costs for a Level 3 or Level 4 SaaS merchant using compliance software, ASV scanning, and periodic QSA advisory typically range from $3,000 to $12,000 per year after the initial year.
For SaaS companies that need enterprise customer contracts, investor due diligence, or cyber insurance, achieving and maintaining PCI DSS compliance is frequently a revenue enabler, not just a cost center. Enterprise buyers and insurance underwriters regularly request Attestations of Compliance as a condition of doing business.
Top Vendors Compared
| Vendor | Specialty | SMB Fit | Pricing | Cert Support |
|---|---|---|---|---|
| Vanta | Automated compliance for SaaS; strong cloud integrations with AWS, GCP, Azure | Good for 20-200 employees; self-serve onboarding | Starts ~$5,000-$8,000/year (PCI module); custom enterprise pricing | SAQ A, A-EP, D; AOC readiness; QSA partner referrals |
| Drata | Continuous controls monitoring; multi-framework support including PCI DSS v4.0 | Good for 50-500 employees; requires moderate setup time | Starts ~$6,000/year; pricing scales by employee count and frameworks | SAQ A through D; maps to PCI DSS v4.0 requirements; QSA partnerships |
| Sprinto | SMB-focused compliance automation; faster time-to-compliance positioning | Strong for 20-150 employees; lower onboarding friction than Vanta/Drata | Starts ~$3,500-$5,000/year for PCI; transparent per-employee pricing available | SAQ A, A-EP, C, D; evidence collection automation; auditor access portal |
| Tugboat Logic (OneTrust) | Policy and risk management focus; part of OneTrust portfolio post-acquisition | Moderate; better fit for companies with existing GRC programs | Custom pricing; typically $8,000+ for PCI module; OneTrust enterprise pricing applies | Full PCI DSS framework; risk assessment workflows; auditor collaboration tools |
| Secureframe | Compliance automation with in-house QSA services for select frameworks | Good for 20-300 employees; offers bundled QSA review for additional fee | Starts ~$4,000-$6,000/year; QSA-assisted assessments quoted separately | SAQ A through D; PCI DSS v4.0 aligned; optional QSA-led assessment add-on |
Key Statistics
- 83 percent of organizations that experienced a payment card breach in 2022 were not fully PCI DSS compliant at the time of the breach.
- Only 43.4 percent of organizations maintained full PCI DSS compliance throughout 2022, down from 47.5 percent in 2020.
- PCI DSS v4.0 introduced 64 new requirements, of which 13 are effective immediately and 51 were designated as best practices until March 31, 2025, when they became mandatory.
- The average cost of a payment card data breach for organizations with fewer than 500 employees is approximately $2.98 million, including detection, notification, and post-breach costs.
- SaaS and cloud-based companies account for approximately 35 percent of all PCI DSS assessments conducted annually, reflecting the migration of payment processing to cloud-hosted platforms.
Frequently Asked Questions
Does using Stripe or Braintree make a SaaS company automatically PCI DSS compliant?
No. Using Stripe, Braintree, or another payment processor reduces your PCI DSS scope but does not eliminate your compliance obligations. You still need to complete the appropriate SAQ, implement controls such as MFA and access logging, and obtain an Attestation of Compliance if required by your bank or customers. Stripe and Braintree are themselves PCI DSS Level 1 certified, which means card data handled within their systems is covered - but your application, infrastructure, and policies remain your responsibility.
What is the difference between PCI DSS v3.2.1 and v4.0 for SaaS companies?
PCI DSS v4.0 became mandatory on March 31, 2024, replacing v3.2.1. Key changes affecting SaaS companies include: mandatory MFA for all CDE access (not just remote access), new requirements for script integrity on payment pages (Requirement 6.4.3), more prescriptive web application firewall requirements, and a customized approach option that allows organizations to meet the intent of a requirement using alternative controls. SaaS companies should verify their current controls against v4.0 requirements, particularly if they use JavaScript-based payment forms.
Does a SaaS company need a QSA to achieve PCI DSS compliance?
Level 3 and Level 4 merchants - typically companies processing fewer than 1 million transactions annually - can complete the Self-Assessment Questionnaire without a QSA. However, hiring a QSA for a scoping review or SAQ D completion is advisable if your architecture is complex or if enterprise customers require a QSA-validated AOC. Level 1 merchants (over 6 million transactions annually) are required to use a QSA for a Report on Compliance. QSAs are listed on the PCI SSC website at pcisecuritystandards.org.
What is cardholder data environment (CDE) scoping and why does it matter for SaaS companies?
The CDE is the set of people, processes, and systems that store, process, or transmit cardholder data, plus any systems that could affect the security of those systems. Accurate scoping determines which PCI DSS requirements apply to you. For SaaS companies, poor scoping is the most common cause of both over-compliance (wasting resources on out-of-scope systems) and under-compliance (missing controls on in-scope systems). Reducing your CDE through tokenization, network segmentation, or redirected payment flows before your assessment can significantly lower your compliance burden.
What happens if a SaaS company is found non-compliant with PCI DSS after a breach?
If a data breach occurs and you are found to be non-compliant with PCI DSS at the time, your acquiring bank can impose fines ranging from $5,000 to $100,000 per month during the period of non-compliance, according to Visa and Mastercard operating regulations. You may also be liable for card replacement costs, forensic investigation fees, and potential card brand penalties. Some cyber insurance policies reduce payouts or deny claims if non-compliance is found to be a contributing factor.
How long does it take a SaaS company to achieve initial PCI DSS compliance?
Timeline depends on your starting security posture and SAQ type. A SaaS company with existing security controls completing SAQ A typically takes 2 to 6 weeks. SAQ A-EP or SAQ C with moderate gaps typically takes 2 to 4 months. SAQ D with significant remediation needs can take 4 to 12 months. Using compliance automation software can reduce timelines by 30 to 50 percent for evidence collection and policy documentation tasks.
Do SaaS companies that only pass payment data through an API need PCI DSS compliance?
Yes, if your API transmits or receives cardholder data - even in transit - your systems are in scope for PCI DSS. The transmission channel itself must use strong encryption (TLS 1.2 or higher under PCI DSS v4.0 Requirement 4.2.1), and the systems involved in that transmission are part of your CDE. Depending on whether card data passes through your servers or is transmitted directly between the customer and the payment processor, your SAQ type and scope will differ.