Which questionnaire applies to you, and why the difference is hours.
The shortest questionnaire is a few dozen questions. The longest runs to hundreds. Which one you answer is decided by how card data reaches your processor, and most small merchants qualify for a much shorter one than they end up filling in.
What this page settles.
Three questions, in the order most people ask them.
How the questionnaire is chosen
One question underneath all of it: does card data ever touch systems you control?
The more completely the answer is no, the shorter your questionnaire. That is the whole logic, and it is worth understanding rather than just answering the portal’s prompts, because it tells you how to make next year easier.
The versions are lettered, and while the exact names and criteria are set by the PCI Security Standards Council and revised periodically, the shape has been consistent: fully outsourced arrangements get short forms, and anything where card data passes through your own environment gets long ones.
The common situations
You take payments only through a standalone terminal that connects directly to the processor, with no connection to your other systems. One of the shortest questionnaires. Most small shops, salons and trades are here.
You take payments only online, and the payment page belongs entirely to your gateway — the customer is redirected, or the form is hosted and embedded in a way where card data never reaches your server. The shortest e-commerce questionnaire.
You take payments online, your site is involved in the payment page but does not receive card data directly — some embedded and JavaScript-based integrations fall here. A longer questionnaire, because your website can affect the security of the payment even without handling the data.
You take payments through a point-of-sale system connected to your network, or through a virtual terminal on a computer you use for other things. Longer again.
Card data reaches your servers, or you store it anywhere. The longest, and the one that is a genuine project rather than an afternoon.
You take payments several ways. The questionnaire has to cover all of them, which usually means the longest that applies to any single channel. This catches a lot of businesses who added online ordering to a shop.
Where merchants get it wrong
Answering a shorter questionnaire than the setup warrants. Sometimes deliberately, usually accidentally — the portal asks a question, the merchant answers optimistically, and a shorter form appears. That is a false attestation, and it matters most at exactly the moment you would least want it to: after an incident.
Forgetting a channel. The shop is on a terminal, and nobody remembered the website, or the phone orders keyed into a computer.
Assuming the terminal covers everything. Hardware can answer the questions about encryption and card storage. It cannot answer the ones about passwords, physical access and who in your business can do what.
Writing card numbers down. On an order form, in a notebook, in a CRM field, on a card machine slip kept in a drawer. Any of these puts card data in your environment regardless of how modern your terminal is, and merchants frequently do not think of it as storage.
Reducing your scope before you answer
The best time to think about this is before you fill anything in, because changing the setup changes the questionnaire.
Move to a hosted or redirected checkout if you currently take card data on your own page. Biggest single reduction available online.
Use a tokenizing gateway so repeat customers are stored as tokens rather than card numbers. How tokenization works.
Stop writing card numbers down. Not sometimes, not for refunds, not for a moment on a notepad. This is free, and it removes a whole category of question.
Keep the payment terminal off your general network where your setup allows it.
Each of those is good practice on its own terms, and each can genuinely shorten next year’s questionnaire. That is the rare case where the compliance exercise points at something worth doing anyway.
What happens after
You complete the questionnaire and the attestation in your processor’s portal.
You run a scan if your setup requires one. Whether yours does.
Validation shows as current, and any non-compliance fee on your statement stops on the next bill.
It lapses in a year. Put a reminder in your calendar at eleven months, because the annual prompt frequently goes to an email address nobody checks and that is how most merchants end up paying the penalty.
What we charge
Interchange + 0.50% + 10¢ in person, interchange + 0.75% + 25¢ keyed. No PCI program fee, no non-compliance fee, no monthly fee, no contract.
Tell us in a sentence how you take payments and we will tell you which questionnaire applies — and whether a small change to your setup would put you on a shorter one next year.
While we are on the subject
Can I choose the shortest one?
No. The questionnaire has to match how you actually take payments. Answering a shorter one than your setup warrants is a false attestation, which is a considerably worse position than the work you avoided.
Who decides which one applies?
You do, in substance, usually guided by your processor’s compliance portal, which asks a few opening questions and selects accordingly. If your setup is unusual, ask your acquirer.
What if I take payments more than one way?
Then the questionnaire has to cover all of them, which generally means the longest one that applies to any channel. This is a common reason merchants end up on a longer form than they expected.
Does changing my setup change my SAQ?
Yes, and that is the useful part. Moving to a hosted checkout or a tokenizing terminal can genuinely move you to a shorter questionnaire next year.