PCI awareness
If you accept cards, PCI DSS expectations apply at a level that matches how you take payments. Most small merchants complete an annual self-assessment questionnaire (SAQ), keep devices and software supported, and avoid storing forbidden data (full track data or CVV after authorization). Your SAQ type depends on channels—card-present terminals, e-commerce, or keyed entry change the picture.
Merchant Services America explains concepts; we are not a substitute for a Qualified Security Assessor when one is required. Deeper product-agnostic overview: payment data security basics.
Staff habits
Technology fails when habits fail. Train teams to:
- Never write full card numbers on sticky notes or in chat/email
- Watch for skimmers and odd attachments on terminals
- Lock screens and limit who can open settlement reports with sensitive fields
- Use unique logins—no shared “manager” passwords on POS
- Report suspicious refunds, tips adjustments, or device swaps immediately
Habits cost less than a breach response. Pair training with supported hardware from a POS & terminals conversation when devices are aging.
Vendor questions
Before you trust a gateway, POS app, or “security add-on,” ask:
- What cardholder data do you store, and where?
- How is data encrypted in transit and at rest?
- Who is responsible for PCI scope—merchant, vendor, or shared?
- What happens if your service has an incident?
- Can you show current attestations without burying them in sales fog?
Common questions
Is PCI only for big retailers?
No. Size changes how you validate, not whether card data must be protected.
Do you sell a named encryption product here?
No unverified partner claim on this page. Ask what is currently available.
What is the #1 staff mistake?
Sending card numbers through email, SMS, or messaging apps.
Does a merchant account make me PCI compliant automatically?
No. An account creates obligations; practices and tools still matter.
Where do I ask security questions?
Ask us via quote or contact.