PCI Compliance for Small Business

If you take cards, you have run into "PCI compliance," usually attached to a fee or a scary email. A lot of what gets said about it's designed to sell you something. Here's what's actually true, in plain answers.

Do I even have to deal with PCI? Yes, if you accept card payments, the standard applies the moment a customer hands over a card. It isn't a law, it's a rule built into your merchant agreement. But "applies to you" doesn't mean "expensive" or "complicated." For most small businesses it's neither.

What level am I? Almost every small business is Level 4, fewer than 20,000 e-commerce transactions a year. Level 4 means you self-attest with a short questionnaire (an SAQ), not a formal audit. You're not in the same world as a national retailer.

What does it actually cost? Here's the part vendors bury: if you don't store card numbers anywhere, compliance for a Level 4 merchant can cost close to nothing, the annual questionnaire is free and the required practices are basic security hygiene. The five-figure horror stories come from businesses that store card data or have complex setups. Keep card data out of your business and you stay in the cheap, simple lane.

What's the single most important thing I can do? Don't store card numbers, expiration dates, or CVV codes anywhere, not in a filing cabinet, not in a spreadsheet, not in your CRM notes, not on recorded calls. The moment card data lives in your business, your compliance burden multiplies. Use a processor and terminal that keep the data out of your hands, and you qualify for the simplest questionnaire (SAQ A).

Which questionnaire will I need? It depends on how you take payments: a hosted online checkout usually means the short SAQ A. A standard countertop terminal usually means SAQ B-IP, and a terminal wired into a POS system usually means SAQ C. Your processor should tell you exactly which one and walk you through it.

Is the "PCI fee" on my statement legit? Sometimes. A small monthly PCI program fee (often a few dollars) can be legitimate. A PCI non-compliance fee (often larger) is charged when you haven't completed your questionnaire, and it's avoidable. If you see one, that's a sign you have paperwork to finish, not a cost you're stuck with.

Bottom line: for a typical small shop that doesn't store card data, PCI is an afternoon and a free questionnaire once a year, not a project. If someone is quoting you thousands to "get compliant," get a second opinion before you pay it.

We set every merchant up to keep card data out of your business, which keeps you in the simplest, cheapest PCI lane, and we'll tell you plainly which questionnaire you need.