# PCI DSS Source: PCI DSS is the card industry's standard for handling card data. A shop whose payers enter their cards only in our payment window never handles card data, and has little to do. ## What it is The Payment Card Industry Data Security Standard, PCI DSS, applies to everyone who stores, processes, or sends card numbers: gjold, your acquirer, and you, if card numbers ever pass through your systems. The card schemes require it, and your acquirer checks it. ## Payment links Card details are entered only in our payment window, on servers that a Qualified Security Assessor audits against PCI DSS every year. Since card data never touches your systems, you usually don't need to fill in a self-assessment questionnaire, an SAQ. That is for your acquirer to decide, and if they ask for one, it is SAQ A, which covers shops that send payers to a PCI DSS compliant provider. Because the window is opened by a redirect and never in a frame, the requirements on payment page scripts, 6.4.3 and 11.6.1 in PCI DSS 4.0.1, apply to our window and not to your site. ## Keep it that way This holds only as long as you never handle card numbers yourself: - Don't collect them in your own forms, however you pass them on. - Don't take them by phone or email to type into the window for the payer. Send them a payment link instead. - Don't store them, not even in logs or support tickets. If a payer sends you their card number, delete it. If your acquirer or auditor needs our Attestation of Compliance, the AOC, ask [support@gjold.com](mailto:support@gjold.com).