Step 1
Free Tool
Answer a few plain-language questions about how your business takes card payments and get a clear preliminary answer in minutes.
If you've just been made responsible for PCI, the first real question isn't "how do I become compliant" — it's "which Self-Assessment Questionnaire even applies to my business?" The SAQ you complete defines which requirements you attest to, so choosing the wrong one means either far more work than you need, or — worse — under-reporting your real obligations. The finder above gives you a plain-language starting point in a couple of minutes.
There are several SAQs, and which one fits depends mostly on how your business accepts card payments. A quick orientation (your real situation may differ — that's what the finder and the app are for):
For merchants who fully outsource their cardholder data handling — typically e-commerce sites that redirect customers to a payment provider. It's the shortest path, the one most merchants hope to use, and the one most often chosen incorrectly. The eligibility rules also changed in early 2025, so last year's choice is not proof it still applies.
For e-commerce merchants whose own website can affect the payment transaction or the integrity of the page that captures card details — for example, a checkout page your own site helps build, rather than one delivered whole by your provider. The line between SAQ A and A-EP is subtle and is exactly where merchants get misclassified.
Various card-present, terminal-based, and phone-order scenarios, depending on the type of device, how it connects, and whether it's part of a validated solution. Which one fits hinges on specifics of your equipment and network.
The most comprehensive questionnaire, for merchants and service providers who don't fit the narrower SAQs — and the path for anyone storing cardholder data or running a complex environment.
No. The finder is an orientation tool built on a practitioner-maintained knowledge base. It gets you a likely starting point fast; your acquirer and, where required, your QSA make the formal call. The point is that you walk into those conversations already knowing roughly where you stand.
That's common and completely fine — the uncertainty is usually in how your payment page is built or what's connected to your card systems. Those are precisely the details PCI Clarity is designed to pressure-test with you.
The SAQ Finder gives you a starting point. PCI Clarity helps you confirm it — describe your setup in plain language and get authoritative guidance on scope, requirements, and next steps.
Try PCI Clarity Free →