Frequently Asked Questions

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for businesses that store, process, or transmit credit card data. It was created by Visa, Mastercard, American Express, Discover, and JCB to protect cardholder information and reduce fraud. If you accept credit card payments, PCI compliance is required — not optional.

Yes. Even if you never see card data directly, you are still responsible for PCI compliance. Using a PCI-compliant payment processor doesn’t make you compliant — it just simplifies your requirements. Typically, this means completing SAQ A (the simplest form) and ensuring your integrations are secure.

Non-compliance can result in fines from $5,000 to $100,000 per month from your acquiring bank or payment processor. You may also face higher transaction fees, loss of the ability to accept credit cards, and significant liability if a data breach occurs. Most importantly, your customers’ payment data is at risk.

PCI DSS is enforced by the payment card brands (Visa, Mastercard, etc.) through your acquiring bank or payment processor. Your acquirer determines your UK PCI, receives your attestation documents, and can impose fines for non-compliance.

PCI DSS has 12 requirement categories covering areas like firewalls, encryption, access control, vulnerability management, and security policies. Not all requirements apply to every business — your SAQ type determines which ones you must address. See our PCI DSS overview page for a complete breakdown.

An ASV (Approved Scanning Vendor) scan is an external vulnerability assessment performed by a company certified by the PCI Security Standards Council. The scan checks your public-facing systems for security weaknesses, misconfigurations, and known vulnerabilities that could put cardholder data at risk.

If your SAQ type requires vulnerability scanning, it must be performed by an ASV every 90 days (quarterly). You also need scans after any significant changes to your infrastructure. SAQ A and SAQ B typically don’t require ASV scans; most other SAQ types do.

Don’t panic — it’s common for first scans to identify issues. You’ll receive a detailed report showing what failed and why, with severity ratings and remediation guidance. We help you fix the issues (called remediation) and perform free re-scans until you pass. Most issues can be resolved within days.

Most scans complete in under an hour, depending on the number of IP addresses and services being scanned. Larger environments with many targets may take longer. You’ll receive your results immediately after the scan finishes.

Yes, if your SAQ requires them (SAQ C, D, and others). Internal scans check systems inside your network and can be performed by your own team or a third party — they don’t need to be done by an ASV. However, ASV external scans must be performed by a certified vendor.

ASV scans are designed to be non-disruptive. They passively probe your systems for vulnerabilities without exploiting them or affecting performance. You can schedule scans during off-peak hours if you prefer, but most businesses run them during normal operations without any impact.

Our plans start at $149/year, which includes SAQ guidance and quarterly ASV scanning. This is far less than the potential cost of non-compliance fines ($5,000-$100,000/month) or the devastating impact of a data breach.

No hidden fees. Our pricing is transparent and all-inclusive. Your plan covers scanning, SAQ completion, documentation, and support. Unlimited rescans are included at no extra cost.

We offer both monthly and annual billing options. Annual plans provide the best value with significant savings compared to monthly billing. All plans include the same features and support.