I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business.

At one point, I have two choices:

1) Customers submit payments at a different web address (i.e. separate website for checkout/payment)

2) Customers submit payments on my website (i.e. checkout/payment is part of my website)

I am using a third-party JS widget to handle the entire e-commerce side, which is provided by BookingBug Ltd, a PCI-compliant entity. With this widget, the payment data never touches my server, so I have no card data environment. Notably, I don't control the JS; it is dynamically loaded via a URL under BookingBug Ltd's control. Am I number 1) or 2)?

I started working with 2), but none of the followup questions seemed to apply. Moreover, they seemed far more involved than the average business owner could answer reasonably.

2 Answers 2


Only a QSA can give you a qualified answer, but I can give you my view.

It's probably making a distinction between SAQ A and SAQ A-EP. Does the BookingBug widget work via an iFrame or does it do a whole page redirect? In that case you're likely SAQ A so #1 would apply.

If the credit card data touches your frontend interface at all, then you would be bumped up to SAQ A-EP, so #2 would apply. If it touches your server, you'd be bumped to SAQ D.

You're responsible for ensuring your third party services are PCI compliant and are handling it in such a way as to reduce your scope. Short answer to make sure the widget is using an iFrame or full page redirect.


I'm not a QSA, nor, more importantly your QSA - this is not to be taken as PCI advice

I would say you come under #1 because cardholder data does not pass through your system - it goes directly from the web browser to the payment gateway. Your site can affect the security of card data, as you are hosting the redirect page, therefore PCI compliance, as you have noted, is compulsory.

In that case you should be completing SAQ A-EP if you are self assessing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .