PCI-DSS
How do you ensure your transactions are security compliant?
Understand PCI-DSS
PCI-DSS (Payment Card Industry Data Security Standard) is an international security standard that establishes technical and operational requirements to protect payment card data.
These requirements apply to organizations that store, process, or transmit card data, and also to those whose systems can affect the security of this data.
In the integration with Asaas, the scope of your responsibilities depends on how the data is collected, which systems it passes through, and where it is stored. This page explains how different integration methods influence this scope and which precautions your company should consider.
When PCI-DSS applies
PCI-DSS applies when your systems store, process, or transmit card data, or when you maintain systems that can affect the security of this data. This includes situations in which your company performs one or more of the following activities.
- Receives card data in its application.
- Stores the full card number, including in logs or transaction records.
- Controls the page where the customer enters the card data.
- Maintains systems that can affect the security of collecting or sending this data.
Even if your company does not store card data, it may have compliance responsibilities. The systems and processes covered by PCI-DSS depend on the integration method and the path the data takes.
Shared responsibility
Asaas is responsible for the security of the card data handled in its own environment. Your company remains responsible for the security of the systems and processes under its control.
Depending on the integration method, your company's responsibilities include the following activities.
- Protect the collection and transmission of card data to Asaas.
- Restrict access to data and systems to authorized people.
- Keep the infrastructure protected and fix vulnerabilities.
- Protect activity records (logs) and prevent card data from being improperly included in them.
- Guide and train the people involved in the operation on security precautions.
Using the services of a certified provider can reduce your company's systems and processes covered by PCI-DSS. However, the provider's certification does not automatically extend to your integration, nor does it replace the security controls under your responsibility.
Impact of the integration method
| Method | Card data handling | Possible impact on scope |
|---|---|---|
| Asaas Checkout | The data is entered on a page controlled by Asaas | May reduce your company's scope |
| Asaas Invoice page | The payment takes place in an interface controlled by Asaas | May reduce your company's scope |
| Payment Link | The customer enters the data on the Asaas page | May reduce your company's scope |
| Asaas API | The data passes through your application's back end before being sent to Asaas | Your infrastructure remains in scope |
| Server-side tokenization | The data passes through your server before tokenization | Your infrastructure remains in scope |
The integration method alone does not determine the applicable SAQ type.
The definition depends on the entire data flow, the application architecture, and the eligibility criteria established by PCI-DSS and by the entity responsible for validation.
Common SAQ types
The SAQ — Self-Assessment Questionnaire — is a tool used by eligible organizations to assess and declare their compliance with the applicable PCI-DSS requirements.
Among the most common types in online operations are:
| Type | General application |
|---|---|
SAQ A | Operations in which card data processing is outsourced and the company's systems do not store, process, or transmit this data electronically |
SAQ A-EP | E-commerce that outsources processing but has systems that can affect the security of the page or transaction |
SAQ D | Organizations that do not meet the eligibility criteria of the shorter questionnaires |
Before filling out an SAQ, confirm that your operation meets all of the corresponding eligibility criteria.
The current documents are available in the official PCI SSC document library.
PCI-DSS at Asaas
Asaas holds PCI-DSS Level 1 certification and undergoes periodic external assessments to verify its compliance with the standard's requirements.
The certification covers the environments and processes under Asaas's responsibility. It does not automatically extend to your company's systems, which must meet the requirements applicable to your integration.
Data that cannot be stored
Do not store sensitive authentication data after the transaction is authorized, even if it is encrypted. This prohibition includes the card security code (CVV), the full magnetic stripe track data, and the PIN or PIN block.
Storing the full card number requires a justified need and compliance with the applicable PCI-DSS controls. Encryption alone does not eliminate these obligations.
Review your application to prevent card data from being improperly recorded in the following locations:
- Logs and error messages.
- Monitoring tools.
- Databases and backups.
- Customer service systems.
Before implementing card payments
- Map where the card data flows.
- Identify which systems receive or transmit this information.
- Check whether any data is stored in logs or databases.
- Confirm the scope and the applicable validation method.
- Implement the necessary security controls.
- Keep compliance evidence up to date.
Need guidance?
To define your operation's scope, the applicable SAQ, or the need for an audit, contact a QSA — Qualified Security Assessor — company or a consultancy specializing in PCI-DSS.
Updated 15 days ago