PCI compliance
Last updated: August 19, 2026
All merchants that accept payment cards are required to comply with the Payment Card Industry Data Security Standards (PCI DSS).
Checkout Technology Ltd, a company within the Checkout.com group, is certified as a PCI DSS Level 1 Service Provider, which is the highest standard set by the payment card industry.
When accepting payments, you must do so in a PCI-compliant manner. You can simplify your PCI compliance if you:
- Integrate with Flow, Hosted Payments Page, Payment Links, or our Mobile SDKs. With these integration methods, you can accept payments without ever handling card data.
- Use Transport Layer Security (TLS) for all payment pages, so that they use HTTPS.
- Review and validate your PCI compliance once a year – most merchants can do this with a Self-Assessment Questionnaire (SAQ), which is provided by the PCI Security Standards Council.
The type of SAQ you need to provide depends on your integration method. If you use:
- Flow, Hosted Payments Page, Payment Links, Frames, or our Mobile SDKs – You need to provide SAQ A.
- Our Full Card API with your own integration platform – You need to provide SAQ D.
- Our Full Card API with a third-party service provider – Contact your account manager.
If you're SAQ D PCI compliant and want to process full card payments, contact your solution engineer or request support.
Information
If you change how you integrate with us, you may need to re-certify your PCI compliance. For example, if you reintegrate from Frames to our Full Card API, you'll have more access to cardholder data, so your requirements may change.
Merchants are organized under four levels of PCI compliance, based on their card transaction count over a 12-month period. Your PCI level and integration method will determine the compliance requirements you must meet.
Level 1 merchants are subject to more stringent requirements than level 2 – 4 merchants. If you reach level 1 (more than 6 million transactions), we'll identify this and contact you to make sure you can provide the relevant documentation and stay compliant.
Learn more about PCI compliance levels and key requirements.
Your PCI DSS certification needs to be reviewed and validated once a year. Qualified Security Assessors (QSAs) are independent security individuals and organizations, approved by the PCI Security Standards Council, that validate an entity's adherence to the PCI DSS. A QSA can help you choose the right SAQ for your business and support you through the process.
Checkout.com has partnered with ZeroRisk, a merchant security provider, to help you with PCI compliance. In the ZeroRisk portal, you can complete your SAQ, run your quarterly Approved Scanning Vendor (ASV) vulnerability scans, and track your compliance status in one place.
ZeroRisk is best equipped to answer specific questions about your scope of compliance. To contact their support team, send an email to pcisupport.checkout@zerorisk.io or visit the ZeroRisk Contact Us page.
Note
Data security is extremely important to us. If you believe the security of your integration may have been compromised, or have any questions concerning your PCI obligations, contact us at pci.operations@checkout.com.
Information
ZeroRisk replaced SecurityMetrics as our PCI compliance partner in April 2026. If you were enrolled with SecurityMetrics:
- Your latest SAQ submission and ASV scan dates were migrated, and your renewal date is unchanged.
- Any services you bought directly from SecurityMetrics continue as normal. Only your core PCI compliance activity (your SAQ and ASV scans) has moved to ZeroRisk.
- ZeroRisk features carry no additional cost to you.
To request compliance records from before April 2026, contact scheme.reporting@checkout.com.
When you complete your onboarding with us, we'll register you with ZeroRisk so that you can start your PCI assessment. You'll need to provide us with the contact details of the person responsible for PCI compliance in your organization. We create your ZeroRisk account for you, so there's no sign-up step.
You'll then receive an activation email from ZeroRisk, sent from postmaster@zerorisk.io. This email is legitimate and sent on our behalf.
Note
The activation link expires 7 days after ZeroRisk issues it. If your link has expired, or you have not received the activation email, contact scheme.reporting@checkout.com and we'll arrange a new one.
To set up your account:
- Select the activation link in the email from ZeroRisk.
- Set a password and enable multi-factor authentication (MFA).
- Complete the business profiling questionnaire. Your answers route you to the correct SAQ for your integration type.
- Complete your SAQ.
- If ASV scans apply to your compliance, select Security, and then select ASV Scans to add your IP addresses and website URLs. You can set up an automated scan schedule at the same time.
To give colleagues access to the portal, the primary account holder can select the Users icon, and then select Add user.
When your compliance is next due for renewal, ZeroRisk contacts you. From your second validation cycle onward, if nothing has changed in your environment, you can attest that your information is unchanged instead of completing the full questionnaire again.
Note
Data security is extremely important to us. If you believe the security of your integration may have been compromised, or have any questions concerning your PCI obligations, contact us at scheme.reporting@checkout.com.