If you take cards, you have probably seen the letters PCI on a statement, in a welcome email, or in a reminder that said your account was "non-compliant." Most owners ignore it until something goes wrong. It is simpler than it sounds, and a little attention now saves headaches later.
What PCI compliance actually is
PCI DSS is the Payment Card Industry Data Security Standard. It is a set of security rules created by the card brands and maintained by the PCI Security Standards Council. The goal is simple: keep cardholder data from being stolen.
The rules apply to every business that accepts cards, whether you run a food truck or a 50-seat restaurant. You do not need to be a tech company. You just need to handle card data carefully and show that you do.
What you usually have to do
For most small businesses, validating compliance means completing a Self-Assessment Questionnaire, or SAQ, once a year. It is a series of yes/no questions about how you take payments. Which version you fill out depends on your setup:
- Card terminal only, with no card data stored: usually the shortest questionnaire.
- Online checkout hosted by your payment provider: also fairly short, because the card data never touches your website.
- Your own website collecting card details directly, or a POS connected to your network: longer, with more security requirements.
The less card data passes through your own systems, the less you have to prove. That is the single biggest lever you have.
Habits that make compliance easy
Most of PCI comes down to ordinary good practice:
- Never write down card numbers on paper, sticky notes, or order forms.
- Never accept or send card numbers by email, text, or chat. If a customer sends one, do not reply with it, and delete the message.
- Do not store card numbers in spreadsheets, notes apps, or your CRM.
- Change the default passwords on terminals, routers, and POS software.
- Keep terminal firmware, POS software, and your website plugins up to date.
- Give each employee their own login, and remove access when someone leaves.
- Keep your payment devices off the guest Wi-Fi.
- Check card terminals regularly for anything that looks added or tampered with, like loose parts or strange attachments.
None of this is glamorous. It is the payments version of locking the door at night.
Choose a setup that keeps card data away from you
The easiest way to stay compliant is to never see the card number at all. A few ways to do that:
- Use a modern terminal that encrypts card data the moment it is read.
- For online sales, use a hosted checkout or a gateway that collects card details on its own secure page rather than on yours.
- Use a virtual terminal or invoice link for phone orders, instead of typing numbers into your own software and saving them.
- Ask any vendor or software you use whether it stores card data, and where.
VOXEPAY never stores card numbers, and that is a good question to ask any provider you work with.
The PCI line on your statement
Many providers charge a monthly or annual PCI fee, and some add a separate non-compliance charge if you have not completed your questionnaire. This varies a lot from one provider to the next, so there is no single answer to what is normal.
When you read your statement, look for:
- A line labeled PCI, security, or compliance.
- Whether it is billed monthly or yearly.
- Whether there is a separate non-compliance or validation charge.
- What you actually get for the fee, such as access to the questionnaire, scanning tools, or support.
If a non-compliance charge is showing up, it often means the questionnaire was never completed, not that you did something unsafe. Finishing it can sometimes make that line go away, but confirm with your provider.
What happens if you ignore it
Compliance is not just paperwork. If a breach happens and you are not compliant, you can face fines, forensic investigation costs, and the loss of your ability to take cards. For a small business, that kind of hit can be hard to recover from. A completed questionnaire and a few good habits do not make you invulnerable, but they put you in a far better position.
A simple yearly routine
You do not need a project plan. Try this:
- Put a calendar reminder once a year to complete your SAQ.
- Review who has access to your terminals, POS, and payment portal.
- Update passwords and software.
- Confirm that no one on your team is writing down or storing card numbers.
- Look at your latest statement for any PCI-related lines you do not understand.
That is about an hour or two, once a year, plus staying consistent the rest of the time.
Not sure where you stand?
If you cannot tell whether you have completed your PCI validation, or you are not sure what that line on your statement covers, we are happy to help. Ask for a free statement check and a VOXEPAY specialist will walk through your statement with you and explain what each line means. You can also write to support@voxepay.co with questions. Exact pricing is always confirmed by a specialist.