You Process Cards In-Store and Online — Here’s What That Means for PCI Compliance
Most furniture stores handle payments across multiple channels: point-of-sale terminals in the showroom, e-commerce for online shoppers, and phone orders for custom pieces. This multi-channel reality typically lands you in SAQ D territory — the most comprehensive self-assessment questionnaire — unless you’ve implemented specific technologies to reduce scope. The biggest mistake furniture retailers make? Assuming their POS vendor handles all compliance requirements when they’re actually responsible for the entire cardholder data environment.
How Furniture Stores Process Payments
Your payment environment likely includes several distinct channels that each bring their own PCI compliance requirements. In the showroom, you’re running POS terminals — either standalone devices or integrated systems tied to your inventory management. Online, your e-commerce platform processes orders through a payment gateway. Phone orders for custom furniture create another compliance challenge, especially if staff write down card numbers or enter them into non-compliant systems.
The typical technology stack includes:
- POS systems: Square, Clover, or industry-specific solutions like STORIS or PROFITsystems
- E-commerce platforms: Shopify, WooCommerce, BigCommerce, or custom builds
- Payment processors: First Data, Worldpay, or payment facilitators like Stripe
- Back-office systems: QuickBooks, SAP, or furniture-specific ERPs
Cardholder data flows through multiple touchpoints in your environment. Card numbers pass through POS terminals, get transmitted to processors, may be stored in e-commerce databases, and could end up in email if customers send their details for phone orders. Even temporary storage in browser caches or log files brings those systems into scope.
This complexity typically means SAQ D for Merchants — all 329 requirements apply to your environment. However, many furniture stores can qualify for simpler SAQs through scope reduction:
- SAQ B-IP: If you only use standalone IP-connected terminals with no electronic cardholder data storage
- SAQ A-EP: For e-commerce-only businesses using hosted payment pages
- SAQ C: If you have a payment application connected to the internet but no electronic storage
Industry-Specific Compliance Challenges
Furniture retail presents unique challenges that complicate PCI compliance. Legacy POS infrastructure tops the list — many stores still run decade-old systems that can’t support modern security controls like point-to-point encryption (P2PE) or tokenization. Upgrading means replacing not just payment terminals but often entire inventory management systems.
Multi-location complexity affects most furniture retailers operating showrooms, warehouses, and clearance centers. Each location processes cards differently — the main showroom might have modern terminals while the clearance center uses an old dial-up device. Your compliance scope includes every location that touches card data, and the weakest link determines your overall security posture.
Custom order workflows create compliance headaches when sales staff take orders over multiple interactions. Card details might get written on order forms, entered into non-compliant databases, or stored in email threads about custom specifications. These manual processes bring additional systems and personnel into your cardholder data environment (CDE).
Seasonal staff and high turnover mean constantly training new employees on payment security. During peak seasons like Black Friday, temporary staff handle sensitive payment data with minimal training. Your compliance program must account for this revolving door of personnel with CDE access.
Your Compliance Roadmap
Step 1: Determine Your Merchant Level and SAQ Type
Your acquiring bank assigns your merchant level based on annual transaction volume:
- Level 4: Under 20,000 e-commerce or 1 million total Visa/Mastercard transactions (most furniture stores)
- Level 3: 20,000 to 1 million e-commerce transactions
- Level 2: 1 to 6 million total transactions
- Level 1: Over 6 million transactions
Use the free SAQ Wizard at PCICompliance.com to identify your correct self-assessment questionnaire based on your actual payment channels and technologies.
Step 2: Map Your Cardholder Data Flow
Document how card data moves through your environment from swipe to settlement. Include:
- Physical terminals and their network connections
- E-commerce data flow from checkout to processor
- Phone order procedures and any manual card handling
- Back-office systems that might store or transmit card data
- Third-party services like payment gateways or fulfillment systems
Step 3: Identify Scope Reduction Opportunities
Look for technologies that remove systems from PCI scope:
- P2PE-validated solutions that encrypt card data at the terminal
- Hosted payment pages that keep card data off your e-commerce servers
- Tokenization to replace stored card numbers with non-sensitive tokens
- Network segmentation to isolate payment systems from general IT infrastructure
Step 4: Implement Required Controls
Based on your SAQ type, implement the necessary security controls:
- Install and maintain firewalls (Requirement 1)
- Change default passwords on all systems (Requirement 2)
- Protect stored cardholder data through encryption (Requirement 3)
- Encrypt transmission across public networks (Requirement 4)
- Use and update anti-virus software (Requirement 5)
- Develop secure systems and applications (Requirement 6)
- Restrict access by business need-to-know (Requirement 7)
- Assign unique IDs to each person with access (Requirement 8)
- Restrict physical access to cardholder data (Requirement 9)
- Track and monitor all CDE access (Requirement 10)
- Test security systems regularly (Requirement 11)
- Maintain an information security policy (Requirement 12)
Step 5: Complete Your SAQ and Schedule ASV Scans
Work through your identified SAQ, answering each question based on your actual controls. If you can’t answer “yes” to a requirement, implement the missing control or document a compensating control that provides equivalent security.
Schedule quarterly ASV scans for any internet-facing systems in your CDE. PCICompliance.com’s ASV service automatically schedules and runs these scans, providing remediation guidance for any vulnerabilities found.
Step 6: Submit Your AOC and Maintain Compliance Year-Round
Once you’ve completed your SAQ and passed your ASV scans, submit the Attestation of Compliance (AOC) to your acquirer. Mark your calendar for:
- Quarterly ASV scans (every 90 days)
- Annual SAQ updates
- Security awareness training for all staff with CDE access
- Regular reviews of your payment environment for changes
Realistic timeline: Most furniture stores need 3-6 months for initial compliance, depending on current security posture and scope reduction efforts. Budget $5,000-$25,000 for technology upgrades and consulting, with ongoing costs of $2,000-$10,000 annually for scanning, monitoring, and maintenance.
Scope Reduction for Furniture Retail
P2PE-validated terminals offer the most dramatic scope reduction for furniture stores. These solutions encrypt card data at the moment of swipe or dip, keeping it encrypted until it reaches the processor. With P2PE, your in-store systems never touch readable card data, potentially moving you from SAQ D to SAQ B-IP — reducing your requirements from 329 to about 40.
Hosted payment pages provide similar benefits for e-commerce. Instead of handling card data on your servers, customers enter payment information on a secure page hosted by your payment provider. The provider sends you a token for the transaction while keeping sensitive data off your infrastructure. This approach can qualify you for SAQ A-EP instead of SAQ D for your online channel.
Tokenization helps with recurring billing and returns. When customers finance furniture purchases or save cards for future orders, tokenization replaces their card numbers with non-sensitive tokens in your database. The actual card data stays with your payment processor, removing your storage systems from PCI scope.
The cost-benefit analysis typically favors scope reduction for furniture retailers. Implementing P2PE terminals might cost $10,000-$20,000 across all locations, but it eliminates the need for network segmentation, intrusion detection systems, and many other SAQ D requirements that could cost significantly more to implement and maintain.
Best Practices From Compliant Furniture Retailers
Successful furniture stores separate payment processing from business operations. They use P2PE terminals that don’t integrate with inventory systems, keeping their POS infrastructure out of scope. For custom orders, they use secure payment links instead of taking card details over the phone.
Staff training programs focus on practical scenarios: never write down card numbers, never email card data, and always use the designated payment terminals. The best programs include monthly reminders and annual refreshers, not just one-time training during onboarding.
Technology recommendations from compliant furniture retailers:
- Clover or Square terminals with P2PE for in-store payments
- Shopify Plus or BigCommerce for e-commerce with hosted checkout
- Authorize.Net or Stripe for secure payment processing
- CallPotential or Podium for texted payment links instead of phone orders
Documentation strategies that work include maintaining a simple payment procedure guide at each register, posting “never write down card numbers” signs in back offices, and creating a one-page guide for handling phone orders securely.
FAQ
Do I need PCI compliance if I only use Square terminals?
Yes, you still need PCI compliance even with Square or similar payment facilitators. While Square handles much of the security burden, you’re responsible for physical terminal security, network protection, and staff training. Most Square users qualify for SAQ B-IP, which has about 40 requirements instead of the full 329.
Can I take custom furniture orders over the phone without expanding my PCI scope?
Phone orders traditionally require SAQ D compliance because staff interact with card data. However, you can maintain simpler compliance by using secure payment links — text or email customers a link to enter their own payment information on a secure hosted page.
What if my old POS system can’t support encryption?
Legacy systems that can’t encrypt card data must be replaced or isolated. If replacement isn’t immediately feasible, implement compensating controls like physical security cameras, daily log reviews, and restricted access. However, plan for system replacement within 12-18 months as compensating controls require QSA approval and ongoing justification.
How do furniture financing and payment plans affect PCI compliance?
If you store card data for recurring payments, you must meet all Requirement 3 storage controls including encryption at rest. Most furniture stores avoid this by using payment processor tokenization — store only tokens while the processor handles the actual card data and recurring charges.
What about using iPads or tablets as mobile POS devices?
Tablets used for payment processing must meet the same security requirements as traditional terminals. Use only PCI PTS-approved card readers, keep tablet software updated, and never jailbreak or root devices. Consider solutions like Square Reader or PayPal Here that provide validated P2PE encryption.
Should each store location complete its own SAQ?
Typically, no. If you operate multiple locations under the same business entity and merchant account, you complete one SAQ covering all locations. However, each location must meet the same security standards — your weakest location determines your overall compliance posture.
Conclusion
Furniture store PCI compliance doesn’t have to be overwhelming. While your multi-channel payment environment creates complexity, the right technology choices can dramatically simplify your path to compliance. P2PE terminals for in-store payments, hosted checkout pages for e-commerce, and secure payment links for custom orders can reduce your scope from hundreds of requirements to just dozens.
PCICompliance.com gives you everything you need to achieve and maintain PCI compliance — our free SAQ Wizard identifies exactly which questionnaire you need, our ASV scanning service handles your quarterly vulnerability scans, and our compliance dashboard tracks your progress year-round. We’ve helped hundreds of furniture retailers navigate compliance, from single showrooms to multi-state chains. Start with the free SAQ Wizard to identify your requirements, or talk to our compliance team about building a scope reduction strategy that fits your payment environment and budget.