SAQ C-VT walkthrough: virtual terminal on a dedicated computer
By Sam Rivera, Founder, SentinelPanda · June 3, 2026 · 2 min read · PCI DSS
SAQ C-VT is narrow: a virtual terminal in a browser, one computer, one transaction at a time, no storage. The "isolated computer" requirement is the hard bit.
Who SAQ C-VT is for
SAQ C-VT applies to merchants who accept card payments only by manually keying transactions into a PCI-validated TPSP's web-based virtual terminal. The browser is on a single computer dedicated to virtual-terminal use; the computer is not used for general office work; no cardholder data is stored on the merchant's systems.
Common qualifying patterns: a sole-practitioner consultancy that takes occasional MOTO payments via a dedicated laptop running only a browser pointed at the gateway's virtual terminal; a healthcare practice that uses a dedicated front-desk terminal for card payments and nothing else.
The eligibility checklist
- You use only a hosted virtual terminal accessed via a web browser.
- Transactions are entered one at a time; no batch processing.
- The computer is dedicated to virtual-terminal use only — no email, no general browsing, no other applications.
- No cardholder data is stored electronically on the merchant's systems.
- No e-commerce, no card-present terminals, no other payment channels.
The requirement subset
SAQ C-VT has about 80 control questions. The character of the SAQ is dominated by the isolation requirement — the dedicated computer must be hardened, kept up to date, malware-protected, and used only for virtual-terminal access.
Specific controls: anti-malware on the dedicated computer (Req 5), patch management for OS and browser (Req 6), strong access controls and unique IDs (Req 8), physical security of the computer (Req 9), basic logging (Req 10), and the Req 12 programme. The TPSP attestation and the written agreement (Req 12.8) carry significant weight.
Common SAQ C-VT pitfalls
- "Dedicated" computer that staff also use for email or general browsing — disqualifies SAQ C-VT.
- Multiple users sharing a single login on the dedicated computer — Req 8 fails.
- No patching cadence because "we use it rarely" — Req 6 still applies.
- Storing customer card numbers in a CRM or spreadsheet "for refunds" — instantly disqualifies and pushes you to SAQ D.
A worked example
A massage therapist runs her practice from a single front desk. A dedicated laptop on a separate WiFi SSID is used only to access the gateway's virtual terminal in a browser; no email, no other software. Anti-malware runs; the OS and browser auto-update; the laptop is locked when she steps away; access requires a unique password per staff member. She signs SAQ C-VT annually with the TPSP attestation and the device inventory.
Total: 2-3 weeks first time, 1 week revalidation.