PCI SAQ types: which questionnaire is yours?
Eight Self-Assessment Questionnaires cover every merchant that doesn't need a ROC. Your card-acceptance method -- not your size -- decides which one applies.
Most e-commerce merchants on hosted payment pages use SAQ A (shortest); custom checkout pages that touch payment security use SAQ A-EP; standalone terminals use SAQ B-IP; everyone else lands on SAQ D. Confirm your type with your acquirer in writing.
| SAQ | Eligibility | Typical example |
|---|---|---|
| SAQ A | Fully outsourced card processing (redirect or iframe); your site does not affect payment security. | E-commerce on hosted payment pages |
| SAQ A-EP | E-commerce where your website affects payment-page security. | Custom checkout pages with third-party scripts |
| SAQ B | Imprint-only or standalone dial-out terminals; no electronic card data storage. | Old-school imprint or dial-out terminals |
| SAQ B-IP | Standalone IP-connected PTS-approved terminals; no electronic card data storage. | Modern standalone POS terminals |
| SAQ C-VT | Web-based virtual terminals; no electronic card data storage. | Keyed entry via a browser terminal |
| SAQ C | Payment application systems connected to the internet; no electronic card data storage. | POS systems on an internet-connected network |
| SAQ P2PE | Hardware payment terminals in a validated P2PE solution only. | Validated point-to-point encryption |
| SAQ D | All other merchants -- every applicable requirement applies. | Anyone who doesn't fit A through P2PE |
Know your SAQ type? Get matched with assessors for QSA-assisted validation -- or confirm whether you even need a QSA. Free · 2 minutes.
Get matched quotes→ Full deep dive: SAQ types explained with edge cases · SAQ vs ROC paths · Readiness quiz
Ready to validate?
Get scoped quotes from QSA firms matched to your environment.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.