PCI DSS compliance means meeting the Payment Card Industry Data Security Standard, the security framework that governs how businesses handle credit card transactions and cardholder data. Any company that stores, processes, or transmits payment card information has to comply with it.
The standard was created by the major card networks to reduce card fraud and protect cardholder data across the payment chain. It covers protecting stored cardholder data, encrypting data in transit, controlling who can access payment systems, and monitoring for vulnerabilities.
Compliance is not optional, and it is not a one-time certification. Businesses that accept card payments have an ongoing obligation to maintain it, and the requirements that apply depend on transaction volume and how card data moves through the business. The right Self-Assessment Questionnaire (SAQ) for a given merchant depends on the specifics of that business and the requirements of its merchant bank, so it is worth confirming directly with a merchant bank or a qualified PCI-DSS assessor rather than assuming one SAQ type fits every business.
Why it matters
Non-compliance puts a business at risk in a few ways. Card networks and merchant banks can levy fines, a breach involving unprotected cardholder data can damage customer trust, and in serious cases a business can lose the ability to accept card payments at all. For subscription businesses, where a customer's card stays on file for recurring billing, keeping that stored data secure is a standing responsibility rather than something to check once at signup.
It helps to be clear about where responsibility sits. A provider's own PCI compliance, such as Recurly's, can help merchants reduce their exposure, but it does not replace a merchant's obligation to maintain their own compliance. Every business that accepts card data still has to complete its own assessment.
How to approach PCI DSS compliance
A subscription business generally works through PCI DSS compliance in a few steps:
Determine how card data touches your systems, since your scope depends on whether raw card numbers ever pass through or are stored on your own servers.
Reduce that scope where possible, typically by using hosted payment pages, a hosted checkout, or a JavaScript library that tokenizes card data in the browser so raw numbers never reach your servers.
Complete the Self-Assessment Questionnaire that matches your business model and confirm it with your merchant bank or a qualified assessor.
Maintain ongoing controls such as encryption, access restrictions, and vulnerability monitoring rather than treating compliance as a one-time task.
Benefits and examples
Reducing PCI scope has practical benefits beyond avoiding fines. A subscription business that never touches raw card data internally has less security infrastructure to build and audit, and a simpler SAQ to complete each year.
For example, a subscription business using a hosted payment page for checkout never receives the customer's raw card number on its own servers. The card data goes directly from the customer's browser to the payment provider, which handles the encryption and tokenization. That business still has to complete its own PCI compliance process, but the process is considerably lighter than it would be if the business collected and stored card numbers itself.
Recurly maintains PCI-DSS Level 1 compliance, the highest level the standard defines. Merchants can use Checkout, hosted payment pages, or Recurly.js to keep card data off their own servers entirely, which meaningfully reduces their own PCI scope.
Recurly's gateway token handling works the same way by design. Gateway tokens reference a payment method at the gateway level rather than storing sensitive data such as CVVs, cryptograms, or full track data at Recurly, since storing that data would not be PCI compliant.
Frequently asked questions
What is the difference between PCI DSS compliance and general data security? PCI DSS is specific to payment card data. It sets requirements for how that data is protected, stored, and transmitted. A business can have strong general data security practices and still need to meet PCI DSS requirements separately for anything touching card numbers.
Do I still need to worry about PCI compliance if I use a payment provider? Yes. Using a provider that maintains its own PCI-DSS Level 1 compliance can significantly reduce your scope, especially if you use a hosted payment page or tokenization so card data never touches your servers. But your business still has its own compliance obligation to complete, even if it is a lighter one.
How do I know which Self-Assessment Questionnaire applies to my business? It depends on how your business accepts and handles card data and on your merchant bank's requirements. Recurly recommends confirming the right SAQ with your merchant bank or a qualified PCI-DSS assessor rather than assuming a default.
What happens if my business is not PCI compliant? You risk fines from card networks or your merchant bank, increased fraud liability, and in serious cases the loss of your ability to accept card payments. Exact fine amounts are set by each acquiring bank's merchant agreement rather than published by the card networks or the PCI Security Standards Council.
