Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a merchant website that uses's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't stored at our servers.

Which PCI DSS SAQ applies to us? Which PCI DSS requirements should we conform to?

share|improve this question
up vote 1 down vote accepted

If your systems touch the cardholder data during transmission but you don't store any data, you will be an SAQ C.

For more guidance on determining you SAQ type, see the PCI DSS SAQ Instruction Guide v2.0 page 12, Selecting the SAQ and Attestation that Best Apply to Your Organization.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.