No On-Site QSA Required

Powered by ValueMentor

The fastest, most affordable path to PCI DSS compliance.

If you fully outsource cardholder-data handling to a validated payment processor, you likely qualify for Self-Assessment Questionnaire A — no on-site assessment, no Report on Compliance.
Starting from $1,500.

Starting price$1,500
Assessment typeSelf-assessment (no on-site QSA)
DeliveryRemote, delivered globally
Delivered byValueMentor

The definition

What is PCI DSS SAQ A?

Self-Assessment Questionnaire A (SAQ A) is the shortest PCI DSS validation path, available to card-not-present merchants — typically e-commerce — that fully outsource all cardholder-data storage, processing and transmission to PCI DSS validated third-party service providers (e.g. a hosted checkout page or payment redirect/iframe) and never receive cardholder data electronically themselves. Because your systems never touch card data, there's no on-site QSA-led assessment — you self-assess against the applicable requirements and sign an Attestation of Compliance (AOC). Secusy delivers SAQ A guidance and sign-off support as a fixed-price, self-serve purchase, starting from $1,500.
  • Starting price

    $1,500

  • Assessment type

    Self-assessment (no on-site QSA)

  • Delivery

    Remote, delivered globally

  • Delivered by

    ValueMentor

One fixed-price program

We confirm your eligibility first, then walk you through the questionnaire and finalize your Attestation of Compliance.

Is SAQ A right for you?

SAQ A applies to a specific, narrow scope. Here's what qualifies.

  • Merchant profile

    • Card-not-present merchants — e-commerce or mail/telephone order
    • All payment processing fully outsourced to a PCI DSS validated third party
    • No electronic storage, processing or transmission of cardholder data on your own systems
  • Payment flow

    • Customers pay via a hosted checkout page, redirect or iframe from your payment processor
    • Your website or app never receives, stores or transmits cardholder data
    • No card-present terminals or point-of-sale systems in scope
  • Outcome

    • Completed Self-Assessment Questionnaire A
    • Signed Attestation of Compliance (AOC)
    • No formal Report on Compliance (ROC) required at this validation level

SAQ A probably isn't right for you if:

  • You store, process or transmit cardholder data on your own systems or network
  • You accept card-present (in-person) payments through your own terminals or POS systems
  • Your acquirer or card brand has told you that you're a Level 1 merchant, or requires a QSA-led assessment
  • You use multiple payment processors or a custom-built checkout that touches card data directly

In that case, see our PCI DSS Level 1 program instead, or confirm your validation requirement with your acquirer or payment brand. Not sure which merchant level or validation type applies to you at all? Start with our PCI DSS Level 2 guidance page.

How it works

From eligibility to Attestation of Compliance

  1. Step 1

    Eligibility confirmation

    We confirm your payment flow is fully outsourced and card-not-present — the specific boundary that makes SAQ A the correct validation path rather than a broader SAQ or a full QSA-led assessment.

  2. Step 2

    Questionnaire walkthrough

    ValueMentor walks you through every applicable SAQ A question, including the PCI DSS v4.0.1 requirements covering payment-page script management and change/tamper detection for e-commerce merchants.

  3. Step 3

    Evidence collection

    We help you gather the supporting evidence — your payment processor's PCI DSS validation, hosting/redirect configuration, and any applicable script-management records.

  4. Step 4

    Attestation of Compliance

    Once the questionnaire is complete and evidence supports every answer, we finalize your Attestation of Compliance (AOC) — the document your acquirer or payment brand will request.

Questions

Frequently asked questions

Ready to complete your SAQ A?

Fixed price, self-assessed, delivered through Secusy, powered by ValueMentor.