Plain-English questions, evidence gathered for you, and a signed report your bank accepts. No consultant, no jargon, no 80-page PDF at midnight.
Keyboard works too — press 1 / 2 / 3. The free check confirms your match before anything else.
Got a letter about "PCI DSS validation"? That's normal — every business that takes cards gets one, usually once a year. This is the calm way to answer it.
The glowing line is the whole promise: one guided path from "where do I start?" to signed off. Step 2 is real — try it.
A few plain questions about how you take payments pinpoint which of the 9 SAQs applies — from 16 questions to 218. You never see the ones that don't.
✓ Your form: SAQ A — the short oneEvery requirement becomes a clear task. Connect tools you already use and much of the evidence collects itself — encrypted, organised, ready to show.
Tick the three tasks — feel how it works →Finish, pay once, and a dated, signed PDF lands in your inbox — mapped one-to-one onto the official documents your bank asks for. Next year, your answers are waiting.
✓ Sent to the bank. Done.You sell online and a payment provider handles card data end to end. The shortest common path.
Fully outsourced e-commerceIs this me? →Your site doesn't store card data, but it affects how payment happens — like a custom checkout redirect.
E-commerce, partially outsourcedIs this me? →Card machines on a phone line or standalone dial-out — no card data on any computer system.
Imprint / dial-out terminalsIs this me? →Standalone approved terminals that connect over your internet — isolated from everything else.
IP-connected terminalsIs this me? →A payment application on a system connected to the internet — think POS software on a till.
Connected payment systemsIs this me? →You key in cards one at a time through a provider's web page, on one dedicated machine.
Manual entry, one workstationIs this me? →A validated point-to-point encryption solution — the shortest form of all at 16 questions.
16 questions · validated P2PEIs this me? →You store, process, or transmit card data yourself. Biggest form — exactly where guidance pays off.
Everything-else merchantsIs this me? →You handle card data on behalf of others. The full 218 questions — guided, reusable, organised.
218 questions · service providersIs this me? →Pick the deadline from your letter and see where you stand. No drama — just an honest read.
Pick a date to see your pace. Most short forms are finished the same week they're started.
The standard groups everything under six goals. Click through — none of them are scary in plain English.
Yes. Answering every question, for any of the nine SAQ types, costs nothing and needs no card and no account. You only ever pay if you want the signed PDF report at the end — and the amount is shown right there before you decide.
No — and anyone who tells you otherwise is selling something. The report is evidence of your self-assessment, formatted to map one-to-one onto the official SAQ/AOC documents your bank asks for, so transferring answers is transcription, not rework. The official templates remain free at pcisecuritystandards.org.
Your progress saves as you go, so you can close the tab and come back next week. And there's a human: book twenty minutes with the founder and bring your weirdest question.
The self-assessment covers all nine SAQ types up to the 218-question service-provider form. If you need evidence storage, team review, and more frameworks, the full platform picks up where the check ends — pricing is scoped to your program.
"I've been the person staring at that bank letter. This is the tool I wish I'd had — it walks you through, keeps the paperwork in order, and your data stays yours, exportable anytime."
We're a young product. Our first cohort of merchants is at work right now — their names appear here when they say it's OK. No fake logos, ever.
Under the plain English there's a full platform — PCI DSS 4.0.1 + SOC 2 with five more frameworks, cross-mapped evidence, a three-role audit workflow, and QSA seats in your workspace. Pricing is scoped to your program — let's talk.
Free to complete — you only ever pay if you want the signed report at the end.