Shift4Shop PCI Compliance: What You Need to Know

If you just received a PCI compliance questionnaire from your payment processor and feel overwhelmed, take a deep breath. For most small businesses, PCI compliance is simpler than it sounds. Yes, you need to complete it. No, it’s not as complicated as that dense questionnaire makes it appear. This guide will walk you through exactly what Shift4Shop PCI compliance means for your business and how to get it done without losing your mind.

What Is PCI Compliance (In Plain English)

PCI DSS stands for Payment Card Industry Data Security Standard. Think of it as a set of security rules designed to protect credit card information. If your business accepts Visa, Mastercard, American Express, or Discover — whether online, in-person, or over the phone — these rules apply to you.

The major card brands created PCI DSS through something called the PCI Security Standards Council. But here’s what matters: your payment processor or acquiring bank (the company that handles your credit card transactions) enforces these rules. That questionnaire they sent? That’s them making sure you’re following the rules.

What Happens If You Don’t Comply?

Your payment processor can fine you — typically $50-500 per month for non-compliance. If there’s ever a data breach and you weren’t compliant, you could face much larger fines (think tens of thousands) and be held liable for fraud losses. In extreme cases, you could lose the ability to accept credit cards entirely.

But here’s the good news: most small businesses qualify for the simplest types of compliance questionnaires. You’re not facing the same requirements as Amazon or Walmart.

Do You Need to Be PCI Compliant?

The simple answer: if you accept credit cards in any form, yes. It doesn’t matter if you process one transaction per month or thousands. The moment you accept a credit card payment, PCI DSS applies to your business.

Your Merchant Level

PCI groups businesses into merchant levels based on transaction volume:

Level 1: Over 6 million transactions annually
Level 2: 1-6 million transactions annually
Level 3: 20,000-1 million transactions annually
Level 4: Under 20,000 transactions annually

Most small businesses fall into Level 4. This is good news — it means simpler requirements and self-assessment rather than hiring expensive auditors.

What Your Payment Processor Expects

That questionnaire you received is your payment processor’s way of verifying you’re protecting card data. They need this documentation to show the card brands that their merchants (that’s you) are following the rules. Typically, they’ll ask you to:

Complete a Self-Assessment Questionnaire (SAQ)
Pass quarterly security scans if you have an e-commerce site
Submit an Attestation of Compliance (AOC)

Miss their deadline, and those monthly non-compliance fees start adding up.

Which SAQ Do You Need?

The Self-Assessment Questionnaire comes in different versions, each with different numbers of questions. Choosing the right one depends on how you accept payments. Here’s a plain-English breakdown:

How You Accept Payments	SAQ Type	Number of Questions	Complexity
Redirect to payment processor (PayPal, Stripe Checkout)	SAQ A	~22	Easiest
E-commerce with payment fields on your site	SAQ A-EP	~139	Moderate
Physical terminal only, no electronic storage	SAQ B	~41	Easy
Physical terminal with IP connection	SAQ B-IP	~91	Easy-Moderate
Phone/mail orders, virtual terminal	SAQ C-VT	~125	Moderate
Store card data electronically	SAQ D	~329	Complex

Common Shift4Shop Scenarios

If you’re using Shift4Shop for your online store:

Using their integrated payment gateway where customers never leave your site? You’re likely SAQ A-EP
Redirecting to a hosted payment page? You might qualify for SAQ A
Also have a physical store with card terminals? Your SAQ type depends on the most complex payment method you use

Not sure which one applies? PCICompliance.com’s SAQ Wizard asks you a few simple questions about your payment setup and tells you exactly which SAQ you need — no guessing required.

How to Complete Your SAQ

Once you know which SAQ applies, completing it is straightforward. The questionnaire consists of yes/no questions about your security practices. Here’s what to expect:

What ‘Yes’ Actually Means

When a question asks “Do you have a firewall?” they’re not looking for enterprise-grade security. For most small businesses:

Your router’s built-in firewall counts
Windows Firewall or Mac’s firewall counts
Basic antivirus software satisfies malware requirements

The key is understanding what each question really asks for your business size and setup.

Documentation You’ll Need

Gather these before you start:

Network diagram (can be hand-drawn showing how devices connect)
List of who has access to payment systems
Any security policies (even informal ones)
Details about your payment processing setup

The Quarterly ASV Scan

If you have an e-commerce site, you’ll need quarterly vulnerability scans from an Approved Scanning Vendor (ASV). Don’t panic — this is an automated scan that checks your website for security holes. It typically:

Takes 15-30 minutes to run
Costs $30-100 per scan
Identifies issues you need to fix
Provides a passing report when everything’s secure

Submitting Your Compliance

After completing your SAQ and passing any required scans:
1. Review your answers one more time
2. Complete the Attestation of Compliance (AOC) — this is your official declaration
3. Submit both documents to your payment processor
4. Save copies for your records

Most processors have online portals where you upload these documents. Check the original email they sent for submission instructions.

What It Costs

Let’s talk real numbers. PCI compliance costs vary based on your SAQ type and whether you handle it yourself or use a service:

Typical Annual Costs

SAQ A: $100-300 (mainly ASV scanning)
SAQ A-EP: $200-500 (scanning plus compliance tools)
SAQ B/B-IP: $150-400 (tools and support)
SAQ C-VT: $300-700 (more complex requirements)
SAQ D: $1,000+ (consider professional help)

What You’re Paying For

Compliance platform: $10-50/month for questionnaire tools and guidance
ASV scanning: $30-100 per quarterly scan
Professional help: $150-500/hour if you need a consultant
QSA assessment: $10,000-50,000 (only for Level 1 merchants)

The Cost of Non-Compliance

Before you balk at these costs, consider:

Monthly non-compliance fees: $50-500
Breach fines: $5,000-100,000
Fraud liability: You’re responsible for all fraudulent charges
Lost processing privileges: Priceless — you can’t run a business without accepting cards

For most small merchants, annual compliance costs less than just two months of non-compliance fees.

Staying Compliant Year-Round

PCI compliance isn’t a one-and-done task. Your compliance expires annually, and you’ll need to:

Annual Requirements

Complete your SAQ again (answers might change as your business evolves)
Submit fresh documentation to your processor
Review and update security practices

Quarterly Requirements

Run ASV scans if you have an e-commerce site
Fix any vulnerabilities found
Keep scan reports for your records

When to Reassess

Major changes trigger a fresh look at compliance:

Adding new payment channels (like starting e-commerce)
Changing payment processors
Implementing new payment technology
Significant business growth

PCICompliance.com’s compliance dashboard tracks all these dates and sends reminders before deadlines. No more surprise non-compliance fees because you forgot about a quarterly scan.

Frequently Asked Questions

I’m just a small business. Do I really need to worry about this?

Yes, size doesn’t matter when it comes to PCI compliance. If you accept credit cards, you need to comply. The good news is that requirements scale with business size — you likely qualify for the simpler SAQ types.

What if I only process a few transactions per month?

Transaction volume affects your merchant level, not whether compliance applies. Even one transaction per year means you need to complete PCI requirements. However, lower volume means simpler requirements and lower costs.

Can I just use PayPal or Stripe to avoid PCI compliance?

Using third-party processors can reduce your PCI scope but doesn’t eliminate it. You’ll likely qualify for SAQ A (the simplest type), but you still need to complete it annually. These services handle the complex parts — you handle the basics.

How long does the SAQ take to complete?

It depends on your SAQ type and preparation. SAQ A takes 30-60 minutes. SAQ A-EP or C-VT might take 2-4 hours. SAQ D can take days or weeks — if you’re facing SAQ D, consider professional help.

What if I fail my ASV scan?

Failing is normal on the first try. The scan report shows exactly what to fix. Common issues include outdated software or unnecessary services running. Fix the issues and rescan — most merchants pass within 1-2 remediation cycles.

My payment processor already charges me a “PCI fee.” Isn’t that enough?

That fee is usually for their PCI program or non-compliance — it doesn’t make you compliant. You still need to complete your SAQ and meet all requirements. Think of it like gym membership versus actually working out.

What happens if I get hacked?

If you’re PCI compliant when a breach occurs, you’re in a much better position. You’ll have documented security measures and limited liability. If you’re non-compliant, expect significant fines, full fraud liability, and possible loss of card processing privileges.

Can I do this myself or do I need to hire someone?

Most Level 4 merchants can handle SAQ A, B, or B-IP themselves with good guidance. For SAQ A-EP or C-VT, consider a compliance platform for help. For SAQ D, strongly consider professional assistance — the complexity justifies the cost.

Your Next Steps

PCI compliance might seem daunting at first, but remember — thousands of small businesses complete it successfully every year. Your Shift4Shop store isn’t facing unique challenges. With the right tools and guidance, you can achieve compliance without disrupting your business.

Start by identifying which SAQ type applies to your payment setup. PCICompliance.com’s free SAQ Wizard makes this simple — answer a few questions about how you accept payments, and we’ll tell you exactly which questionnaire you need. From there, our platform guides you through each requirement, handles your quarterly ASV scans, and keeps your compliance documentation organized year-round.

Whether you need help understanding a specific requirement or want someone to review your answers before submission, our compliance team has helped thousands of merchants just like you. Don’t let that compliance questionnaire intimidate you — with PCICompliance.com, you’ll have everything you need to achieve and maintain PCI compliance, protect your customers’ card data, and keep those non-compliance fees at bay.