PCI-DSS
How do you ensure your transactions are security compliant?
Understand PCI DSS
PCI DSS — Payment Card Industry Data Security Standard — brings together technical and operational requirements to protect payment card data.
It applies to organizations that store, process, or transmit card data, as well as those whose systems can affect the security of that environment.
General guidanceThis content provides general information about PCI DSS.
Asaas does not define which certification, validation level, or SAQ questionnaire your company should adopt. For this assessment, consult your acquirer, card brand, compliance provider, or a specialized consultancy.
When PCI DSS applies
Your company may be within the scope of PCI DSS when your application:
- receives card data;
- transmits this data to Asaas;
- stores card-related information;
- controls a page where the data is entered;
- has systems that can impact the security of the payment flow.
The scope varies according to the integration method and the path the data takes.
Shared responsibility
Asaas protects the data processed within its environment.
Your company remains responsible for the systems, pages, servers, and processes under its control, including:
- collecting the card data;
- transmitting the information to Asaas;
- access control;
- infrastructure protection;
- log storage;
- fixing vulnerabilities;
- training the people involved in the operation.
Using a certified provider can reduce your company's scope, but it does not automatically eliminate your responsibilities.
Impact of the integration method
| Method | Card data handling | Possible impact on scope |
|---|---|---|
| Asaas Checkout | The data is entered on a page controlled by Asaas | May reduce your company's scope |
| Asaas Invoice page | The payment takes place in an interface controlled by Asaas | May reduce your company's scope |
| Payment Link | The customer enters the data on the Asaas page | May reduce your company's scope |
| Asaas API | The data passes through your application's back end before being sent to Asaas | Your infrastructure remains in scope |
| Server-side tokenization | The data passes through your server before tokenization | Your infrastructure remains in scope |
The integration method alone does not determine the applicable SAQ type.
The definition depends on the entire data flow, the application architecture, and the eligibility criteria established by PCI DSS and by the entity responsible for validation.
Common SAQ types
The SAQ — Self-Assessment Questionnaire — is a tool used by eligible organizations to assess and declare their compliance with the applicable PCI DSS requirements.
Among the most common types in online operations are:
| Type | General application |
|---|---|
SAQ A | Operations in which card data processing is outsourced and the company's systems do not store, process, or transmit this data electronically |
SAQ A-EP | E-commerce that outsources processing but has systems that can affect the security of the page or transaction |
SAQ D | Organizations that do not meet the eligibility criteria of the shorter questionnaires |
Before filling out an SAQ, confirm that your operation meets all of the corresponding eligibility criteria.
The current documents are available in the official PCI SSC document library.
PCI DSS at Asaas
Asaas holds PCI DSS Level 1 certification and periodically undergoes external compliance assessments.
This certification covers the environment and processes under Asaas's responsibility. It does not automatically certify the systems or infrastructure of the company performing the integration.
Data that cannot be stored
Sensitive authentication data, such as CVV, full track data, and PIN or PIN block, cannot be stored after authorization, even if encrypted.
Also avoid recording full card data in:
- logs;
- monitoring tools;
- databases;
- error messages;
- customer service systems;
- development and staging environments.
Before implementing card payments
- Map where the card data flows.
- Identify which systems receive or transmit this information.
- Check whether any data is stored in logs or databases.
- Confirm the scope and the applicable validation method.
- Implement the necessary security controls.
- Keep compliance evidence up to date.
Need guidance?
To define your operation's scope, the applicable SAQ, or the need for an audit, contact a QSA — Qualified Security Assessor — company or a consultancy specializing in PCI DSS.
Updated 7 days ago