> For the complete documentation index, see [llms.txt](https://docs.ecommerce.seb.ee/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ecommerce.seb.ee/compliance/pci-dss-self-assessment-questionnaires-saq.md). # PCI DSS Self-Assessment Questionnaires (SAQ) What a PCI DSS Self-Assessment Questionnaire is, who may need to complete one, and how the applicable SAQ depends on the payment environment. The Payment Card Industry Data Security Standard (PCI DSS) defines security requirements for environments that store, process, or transmit payment-card account data, or that can affect the security of that data. Eligible merchants and service providers may validate compliance by completing the [Self-Assessment Questionnaire (SAQ)](https://www.pcisecuritystandards.org/document_library/?category=saqs) that matches their environment. ### Every merchant must safeguard payment data Using a PCI DSS compliant payment gateway does not remove the merchant’s own PCI DSS responsibilities. Your validation requirements depend on how your checkout is implemented and whether your systems store, process, transmit, or can affect the security of cardholder data. {% hint style="info" %} The applicable SAQ is determined by the complete payment environment and implementation. Confirm the correct validation method with your acquirer or other organization that manages your PCI DSS compliance program. {% endhint %} ### Common SAQ types for ecommerce The two SAQ types most commonly relevant to ecommerce integrations are: * [SAQ A](https://docs-prv.pcisecuritystandards.org/SAQ%20\(Assessment\)/Instructions%20%26%20Guidance/SAQ-Instructions-Guidelines-PCI-DSS-v4-0.pdf) - For card-not-present merchants that fully outsource account-data functions to PCI DSS validated and compliant third parties. Merchant systems do not electronically store, process, or transmit account data, and the implementation must meet the current SAQ A eligibility criteria * [SAQ A-EP](https://docs-prv.pcisecuritystandards.org/SAQ%20\(Assessment\)/Instructions%20%26%20Guidance/SAQ-Instructions-Guidelines-PCI-DSS-v4-0.pdf) - For ecommerce merchants that outsource payment processing but whose website can affect the security of the payment transaction or the integrity of the payment page. The merchant does not electronically store, process, or transmit account data, but the ecommerce website remains in scope. #### EGW integration and PCI DSS scope The SEB Ecommerce Payment Gateway is PCI DSS Level 1 compliant. Using Hosted Checkout can reduce the amount of cardholder data handled directly by your systems and may therefore reduce your PCI DSS scope. However, using Hosted Checkout does not by itself determine which SAQ applies. SAQ eligibility depends on your complete payment environment, how the payment page is implemented, and whether all eligibility criteria for the relevant SAQ are met. ### PCI DSS version The current [PCI DSS baseline is version 4.0.1](https://www.pcisecuritystandards.org/document_library/?category=saqs). Future-dated requirements became effective on 31 March 2025. Use the current SAQ documents and instructions published by the PCI Security Standards Council. ### Completing and submitting an SAQ Confirm the applicable SAQ, assess its requirements, complete the SAQ and Attestation of Compliance (AOC), and submit the required validation documents to your acquirer or other organization managing your compliance program. For definitions of different SAQ scenarios and additional guidance, see the [SAQ Instructions and Guidelines](https://docs-prv.pcisecuritystandards.org/SAQ%20\(Assessment\)/Instructions%20%26%20Guidance/SAQ-Instructions-Guidelines-PCI-DSS-v4-0.pdf) document published by the PCI Security Standards Council. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ecommerce.seb.ee/compliance/pci-dss-self-assessment-questionnaires-saq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.