PCI DSS
Security requirements for any business handling credit card data. Non-compliance means fines and account termination.
In practice
Shopify and Stripe handle PCI compliance for you. The risk: storing card details in Excel or email is a serious problem.
Common misconception
'PCI doesn't apply to small businesses.' It applies to everyone. Level 4 (under 20K transactions/year) requires only a simple SAQ.
How to fix it
Not sure? (1) is the gateway certified? (pcisecuritystandards.org), (2) are you avoiding storing card numbers? (3) fill out the SAQ.
Example
A phone-order store took orders and typed in card numbers — non-compliant. The solution: a Stripe payment link.
Priority
Are you storing card data anywhere? If so, stop immediately.
Related terms
Keep learning. Metrics that touch the same area:
- Payment GatewayPaymentsA service for accepting payments. Stripe, PayPal, Tranzila, Cardcom. Fee: 1.4-3.5% plus a fixed amount.
- TokenizationPaymentsReplacing a credit card number with a unique string (a token) for storage and reuse. Enables repeat charges without storing card details — reduces breach risk and supports PCI DSS compliance.
- ChargebackPaymentsA customer disputing a charge through their bank. Costs the merchant: a $7-15 fee plus the lost amount. Above 1% puts the account at risk.
- BNPL – Buy Now Pay LaterPaymentsKlarna, PayPlus, Afterpay — interest-free installment payments. Raises AOV by 20-30% but carries a 2-6% fee.
- Refund PolicyPaymentsThe terms and process for refunding a customer. A generous policy raises conversions by 18% on average.
- 3D SecurePaymentsAn additional security layer for card transactions — the customer verifies identity via an SMS code or biometrics. Reduces fraud by 80%+ and shifts liability from the merchant to the issuing bank.
Jimmy tracks your PCI DSS, automatically
WhatsApp alerts when something important changes. No dashboards, no hassle.