Recently I had to implement a website that had to be PCI-DSS compliant.

I am only transferring card details over SSL (encrypted with a random RSA 2048 key generated each time, as well.) The data is then transferred to Stripe. Nothing is stored on my backend in relation to card data.

If I am only handling a few transactions, would a self-assessment suffice?

  • welcome - can you please edit your question to elaborate further on your encryption protocol? feel free to be specific, eg. using pseudo-code and (further) identifying your cryptographic primitives
    – brynk
    Jan 22, 2023 at 5:51
  • Have you looked up the PCI-DSS scoping guidance?
    – schroeder
    Jan 22, 2023 at 12:26
  • @schroeder kind of. its not very clear to me. ive read from several pages that I can do a self-assessment. others say I fall into the category in which self-assessment would not work. I am quite lost on this.
    – LostAllIt
    Jan 22, 2023 at 20:14
  • Please add those conflicting directives to your question and what conditions might apply to you.
    – schroeder
    Jan 22, 2023 at 20:16

1 Answer 1


That’s not answerable without knowing which payment brands are involved. From the PCI DSS 4.0 Quick Reference Guide (https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Supporting%20Document/PCI_DSS-QRG-v4_0.pdf) (my emphasis):

PCI SSC is responsible for developing and managing the PCI Security Standards and related qualification and listing programs; however, each Participating Payment Brand maintains its own separate compliance enforcement programs, including which entities need to validate compliance, validation levels, whether an entity is eligible to complete a Self-Assessment Questionnaire (SAQ) or must complete a Report on Compliance (ROC), and any fines or penalties.

  • I am accepting major CC's and handling banking transactions. So visa,mastercard which require PCI compliance from my understanding.
    – LostAllIt
    Jan 22, 2023 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .