PCI DSS

PCI DSS is the card industry's standard for handling card data. A shop whose payers enter their cards only in our payment window never handles card data, and has little to do.

What it is

The Payment Card Industry Data Security Standard, PCI DSS, applies to everyone who stores, processes, or sends card numbers: gjold, your acquirer, and you, if card numbers ever pass through your systems. The card schemes require it, and your acquirer checks it.

Payment links

Card details are entered only in our payment window, on servers that a Qualified Security Assessor audits against PCI DSS every year. Since card data never touches your systems, you usually don't need to fill in a self-assessment questionnaire, an SAQ. That is for your acquirer to decide, and if they ask for one, it is SAQ A, which covers shops that send payers to a PCI DSS compliant provider.

Because the window is opened by a redirect and never in a frame, the requirements on payment page scripts, 6.4.3 and 11.6.1 in PCI DSS 4.0.1, apply to our window and not to your site.

Keep it that way

This holds only as long as you never handle card numbers yourself:

• Don't collect them in your own forms, however you pass them on.
• Don't take them by phone or email to type into the window for the payer. Send them a payment link instead.
• Don't store them, not even in logs or support tickets. If a payer sends you their card number, delete it.

If your acquirer or auditor needs our Attestation of Compliance, the AOC, ask support@gjold.com.