We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to them, does that mean I need to go down PCI SAQ A-EP ?

I am a little confused and the only way to be PCI SAQ A is to use an iframe or have my application hosted on a PCI-compliant payment processor.

2 Answers 2


That is correct. if you are using the Stripe or similar processors that utilize a redirect method to post payment data to the processor you will use the SAQ A-EP. if you use an iframe or payment is 100% hosted by a compliant service provider then you can fill out SAQ A. Here is a FAQ from the PCI council that explains things in a little more detail:

PCI SSC FAQ - iframes and redirects

  • What does it mean 100% hosted? What if a merchant can build a form on his end, and we will use javascript to turn that form into an iFrame on their page. (All we need is to make it look the same as merchant design it. All future data flow would be 100% trough our servers. Feb 6, 2016 at 13:45
  • What I mean by 100% hosted is, a completely outsourced payment solution. Think PayPal or Google Checkout type of services. When a customer click checkout/pay, they are sent off of your site and to the payment providers site to complete the payment portion of the transaction. This is what is required for SAQ A. Or as stated int he FAQ I linked to 100% of the payment pages must come from a compliant 3rd party, and presented in an iframe.
    – Timee
    Feb 7, 2016 at 16:45

With the newest version of Stripe.js, they are now using an IFrame. This should allow you to remain on SAQ-A. You can read more about that here: What about PCI DSS 3.0?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .