Acuity Scheduling PCI Compliance: What You Actually Need to Know

If you’re reading this because your payment processor just sent you a PCI compliance questionnaire and you’re wondering what you’ve gotten yourself into — take a deep breath. For most small businesses using Acuity Scheduling or similar appointment booking platforms, PCI compliance is simpler than it sounds. Yes, you need to complete it. No, it’s not as complicated as that intimidating questionnaire makes it seem. And yes, we’re going to walk you through exactly what you need to do.

Here’s the reality: if you’re using Acuity Scheduling with standard payment processing, you’re probably looking at one of the simplest compliance paths available. Most small appointment-based businesses qualify for the easiest Self-Assessment Questionnaires (SAQs) that take less than an hour to complete once you understand what’s being asked.

What Is PCI Compliance (In Plain English)

PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules created by the major credit card brands — Visa, Mastercard, American Express, and Discover. Think of it as a security checklist designed to protect your customers’ credit card information. If you accept card payments in any form, these rules apply to you.

The card brands created an organization called the PCI Security Standards Council to manage these standards, but they don’t enforce them directly. That’s where your acquirer (the bank or payment processor that handles your credit card transactions) comes in. They’re the ones who sent you that compliance questionnaire, and they’re the ones who can fine you for non-compliance.

The Consequences of Non-Compliance

Let’s be clear about what happens if you ignore that questionnaire:

Monthly non-compliance fees from your processor (typically $25-100/month)
If there’s a data breach, you’re liable for fraud losses and forensic investigation costs
Your processor can terminate your ability to accept credit cards
Potential fines ranging from $5,000 to $100,000 per month from the card brands

The Good News

Most small businesses using modern payment tools qualify for the simplest compliance requirements. If you’re using Acuity Scheduling with integrated payment processing, you’re already doing most things right. The payment data flows directly from your customer to the payment processor without sitting on your systems — that’s exactly what PCI compliance wants to see.

Do You Need to Be PCI Compliant?

Simple answer: if you accept credit cards, yes. It doesn’t matter if you process one transaction or one thousand, if you’re a solo practitioner or have multiple locations. Credit card acceptance = PCI compliance requirement.

Your Merchant Level

PCI groups merchants into four levels based on annual transaction volume:

Level 4: Under 20,000 e-commerce transactions OR under 1 million total transactions annually (that’s you, most likely)
Level 3: 20,000 to 1 million e-commerce transactions annually
Level 2: 1 to 6 million transactions annually
Level 1: Over 6 million transactions annually

As a Level 4 merchant (which includes most small businesses), you complete a self-assessment rather than hiring an outside assessor. That’s what your payment processor is asking for — a Self-Assessment Questionnaire (SAQ) and an Attestation of Compliance (AOC).

What Your Payment Processor Expects

When your acquirer sends that annual compliance notice, they’re asking you to:
1. Determine which SAQ type applies to your business
2. Complete the questionnaire honestly
3. Fix any security gaps you identify
4. Run quarterly vulnerability scans if required
5. Submit your completed SAQ and AOC

They’re not trying to trip you up — they want you compliant because non-compliant merchants create risk for everyone in the payment chain.

Which SAQ Do You Need?

This is where most people get confused, but it’s actually straightforward once you understand how you accept payments. Here’s the decision tree for Acuity Scheduling users:

Common Acuity Scheduling Scenarios

How You Accept Payments	SAQ Type	Complexity	Questions
Acuity Scheduling with Stripe/Square/PayPal (customer enters card on Acuity’s payment page)	SAQ A	Simplest	~22 questions
Acuity Scheduling + taking cards over the phone	SAQ C-VT	Moderate	~80 questions
Acuity Scheduling + physical card reader in your office	SAQ B or B-IP	Simple	~40 questions
Acuity Scheduling + storing card numbers in your own systems	SAQ D	Complex	300+ questions

SAQ A: The Holy Grail of Compliance

If you only accept payments through Acuity Scheduling’s integrated payment forms (where customers type their card details directly into a payment page hosted by Stripe, Square, or PayPal), you qualify for SAQ A. This is the simplest possible compliance path with only 22 yes/no questions.

SAQ C-VT: Phone Payments

If you take payment details over the phone (even occasionally), you’ll need SAQ C-VT. This applies even if you’re typing those numbers into Acuity Scheduling’s virtual terminal. The moment card data enters your environment verbally, your compliance requirements increase.

When Things Get More Complex

If you’re using a physical card reader connected to your computer or storing card numbers anywhere in your business, you’re looking at more complex SAQ types. Our free SAQ Wizard can help you determine exactly which one applies based on your specific setup.

How to Complete Your SAQ

Once you know which SAQ you need, the actual completion process is straightforward:

What the Questionnaire Looks Like

Your SAQ is a series of yes/no questions about your security practices. For example:

“Do you have a firewall protecting your payment systems?”
“Are passwords required to access payment data?”
“Do you have an incident response plan?”

Here’s the key: “yes” means you’re doing it correctly according to PCI standards. If you answer “no” to any question, you’ll need to either implement that security control or mark it as “not applicable” with an explanation.

Documentation You’ll Need

Before starting your SAQ, gather:

Your payment processing agreements
Network diagrams (even a simple sketch works for small businesses)
Any security policies you’ve written
Vendor agreements for any third-party services that touch payment data

The Quarterly ASV Scan

If your SAQ type requires it (most do except SAQ A), you’ll need to run quarterly vulnerability scans of any systems that face the internet. An Approved Scanning Vendor (ASV) runs these automated scans to check for security vulnerabilities.

The scan process is simple:
1. Provide your public IP addresses or URLs
2. The ASV runs the scan (usually takes a few hours)
3. You receive a report showing any vulnerabilities
4. Fix any failing issues and rescan
5. Submit the passing scan report with your SAQ

Submitting Your Compliance Package

Your complete submission includes:

The completed SAQ questionnaire
The Attestation of Compliance (a one-page form saying you completed the SAQ)
ASV scan reports if required
Any additional documentation your processor requests

Most processors accept these through an online portal, making submission straightforward.

What It Costs

Let’s talk real numbers so you can budget appropriately:

Compliance Platform Costs

SAQ completion tools: $200-500 annually
All-in-one compliance platforms: $300-1,200 annually
DIY approach: Free (but time-intensive and error-prone)

ASV Scanning

Quarterly scans: $200-400 annually for most small businesses
Often bundled with compliance platforms
Required four times per year, not just at assessment time

If You Need Professional Help

QSA consultation: $150-300/hour
Full QSA assessment: $5,000-50,000 (only required for Level 1 merchants)
Remediation assistance: $1,000-5,000 depending on gaps

The Cost of Non-Compliance

Monthly non-compliance fees: $25-100
Data breach costs: $50,000-500,000+
Lost ability to process cards: Incalculable

For most small businesses, annual compliance costs less than $1,000 — significantly less than a single month’s fine for a data breach.

Staying Compliant Year-Round

PCI compliance isn’t a one-and-done checkbox. Your processor will ask for updated compliance validation every year, and certain requirements need quarterly attention.

Annual Requirements

Complete and submit your SAQ
Review and update security policies
Train staff on payment security
Test incident response procedures

Quarterly Requirements

Run ASV scans (if applicable)
Review firewall and router rules
Check for any changes to your payment environment

Tracking Changes

Certain changes require immediate attention:

Adding new payment channels
Changing payment processors
Implementing new software that touches payments
Opening new locations

Set calendar reminders for these compliance tasks. Better yet, use a compliance management platform that tracks deadlines and sends automated reminders.

FAQ

I’m just a small business. Do I really need to worry about PCI compliance?

Yes, every business that accepts credit cards must validate PCI compliance annually. The good news is that small businesses typically qualify for the simplest SAQ types that reflect your actual low risk.

What if I only process a few cards per month through Acuity Scheduling?

Volume doesn’t matter for compliance requirements — even one transaction means you need to comply. However, lower volume does mean you’re in the lowest merchant level with the simplest validation requirements.

Can I just say “yes” to all the questions?

Absolutely not — false attestation is considered fraud and can result in significant penalties. Answer honestly, fix any gaps you identify, and document your remediation efforts.

How often do I need to complete an SAQ?

Annually, though your processor might ask for it at a specific time each year. Quarterly ASV scans are required throughout the year if your SAQ type mandates them.

What happens if I fail my ASV scan?

Failing scans are common on the first attempt. You have time to fix the identified vulnerabilities and rescan. Only the passing scan needs to be submitted with your compliance package.

Is Acuity Scheduling PCI compliant?

Acuity Scheduling maintains its own PCI compliance as a service provider, but that doesn’t make you automatically compliant. You still need to validate your own compliance based on how you use their service.

Can I reduce my compliance requirements?

Yes, by limiting how you handle card data. Using only hosted payment pages (SAQ A) instead of taking cards over the phone (SAQ C-VT) significantly reduces your compliance burden.

What if I need help completing my SAQ?

Start with your payment processor’s resources, use compliance tools like PCICompliance.com’s platform, or consult with a QSA for complex situations. Most small businesses can complete their SAQ without professional help.

Moving Forward with Confidence

PCI compliance might seem overwhelming when you first receive that questionnaire, but for most Acuity Scheduling users, it’s a manageable process. The key is understanding which SAQ applies to your specific payment setup and approaching the questionnaire methodically.

Remember, PCI compliance protects both your business and your customers. Those security questions aren’t arbitrary — they’re asking about real controls that prevent real breaches. Every headline about a data breach represents a business that either wasn’t compliant or wasn’t following the standards they attested to.

PCICompliance.com simplifies this entire process with our free SAQ Wizard that identifies exactly which questionnaire you need based on your payment methods. Our platform includes integrated ASV scanning, step-by-step guidance for each SAQ question, and a compliance dashboard that tracks your progress throughout the year. Whether you’re completing your first SAQ or managing compliance across multiple locations, we provide the tools and support to achieve and maintain PCI compliance without the complexity. Start with our free SAQ Wizard to identify your requirements, or speak with our compliance team about a complete solution for your business.