Online Payments: What the PCI DSS Standard Requires

Accepting online card payments puts your responsibility for data security on the line. The PCI DSS standard defines the basic requirements you must meet. Good news: for most shops, the safest path is also the simplest one — never see the card data.

PCI DSS: What It Is

PCI DSS, or Payment Card Industry Data Security Standard, is a global standard published by the PCI Security Standards Council (PCI SSC). It provides a baseline of technical and operational requirements designed to protect payment account data.

The standard applies to any entity that stores, processes, or transmits cardholder data or sensitive authentication data, or that can influence the security of the cardholder data environment. This includes merchants, regardless of their size or transaction volume.

Two concepts are central:

• Cardholder data (CHD): mainly the card number (PAN) and the cardholder’s name.
• Sensitive authentication data (SAD): notably the security code (CVV) and magnetic stripe data.

What You Can Store (or Not)

The most important rule can be summed up in one sentence: sensitive authentication data must not be retained after authorization, even if encrypted. In practice, you never keep the CVV or magnetic stripe data after payment.

The card number can be stored, but only if it is protected: truncated, masked, or encrypted, and only for a legitimate need. In practice, the more card data you store, the wider your compliance scope becomes — and the heavier the effort.

The winning strategy for a shop is therefore to store nothing at all: entrust checkout to a specialized provider, and never let card data pass through your servers.

Encryption and Transmission

When card data circulates, it must be protected by strong encryption on open and public networks. In other words: all payment data exchanges go through HTTPS (TLS), never in clear text.

A valid SSL certificate on your shop is a prerequisite, not an option. It encrypts the communication between the customer's browser and your server. If payment is outsourced, the certificate remains necessary to reassure the customer and protect the rest of the exchanges. To install it, see SSL Certificate Installation; to choose the right type, see SSL Certificates.

The Role of Hosting and Network

Your hosting provider contributes to the security of the payment environment, even if it never sees the card data. The standard's requirements concern in particular:

• network segmentation, to isolate payment systems from the rest;
• access management and strong authentication;
• security updates and vulnerability patching;
• monitoring and logging.

Managed hosting, with up-to-date patches and an application firewall, reduces the attack surface. Atlas Hoster offers high availability architectures with application firewall and CDN, suitable for shops that process payments. See the high availability offer.

Outsourcing Payment (PSP)

Outsourcing checkout to a payment service provider (PSP) is, by far, the most effective way to reduce your PCI DSS scope. Two common approaches:

• Redirect: the customer is sent to the PSP's payment page, then returns. Your servers never see the card data.
• iFrame or hosted fields: the card form is displayed on your page but managed by the PSP, which receives the data directly.

In both cases, the PSP assumes most of the PCI DSS compliance. You retain a reduced responsibility, often reflected in a simplified self-assessment questionnaire.

Shop Checklist

1. Do not store card data: outsource payment to a PSP.
2. Encrypt: HTTPS everywhere, valid and renewed SSL certificate.
3. Limit access: who can touch the shop's server and admin area?
4. Update: keep your CMS, extensions, and system up to date.
5. Segment: isolate checkout from the rest of the site when possible.
6. Document: track the measures taken, for you and for your acquirer.

For the hosting and availability aspect of a shop, consult E-commerce Hosting: Choose Wisely Before Launching and DDoS Protection: Understand and Protect Yourself. Customer data collection is also covered by law 09-08: see Complying with CNDP: The Checklist for Your Website.

Reducing the Scope: The Key to Effort

The cost of PCI DSS compliance is proportional to the surface area to be protected: the more your systems touch card data, the more controls are required. The most cost-effective approach is therefore to reduce the scope of the cardholder data environment.

Three levers:

• Do not touch card data: by outsourcing payment, you remove this data from your scope.
• Isolate what remains: if part of your system must process card data, segment it from the rest of the network.
• Document: a clear diagram of what is in scope and what is excluded facilitates assessment and validation.

This logic aligns with common sense: the less sensitive data you hold, the less you have to lose, and the less compliance costs you. For a shop, redirecting to a payment provider is often the best first step.

FAQ

Does a small shop need to comply with PCI DSS?

The standard applies to all merchants who accept cards, regardless of their size. Small merchants have simpler environments, which reduces the effort, but the obligation to protect data remains.

Can I store my customers' CVV for one-click purchases?

No. Sensitive authentication data, including the CVV, must not be retained after authorization, even if encrypted.

Who decides the required validation level?

Compliance with the standard is determined by payment brands and your acquirer (bank). It is the acquirer who specifies the type of validation required — often a self-assessment questionnaire for a shop that outsources payment.