---
title: PCI and security
description: What PCI compliance is, how to complete your yearly self-assessment questionnaire, and everyday habits that keep card data safe.
url: https://thepoints.io/docs/merchants/pci-and-security
audience: [merchants]
---

# PCI and security

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security rules for every business that accepts, processes, or stores card data. Staying compliant protects your customers and your business. Falling out of compliance can lead to extra charges and, after a data breach, fines.

## Your yearly PCI steps

1. **Complete a Self-Assessment Questionnaire (SAQ)** each year. It asks how you take payments and how you protect card data.
2. **Run security scans** if your setup needs them. Some setups need regular scans of your website or of the internet connection your terminal uses.
3. **Fix any problems** the questionnaire or scans find, then confirm.

Your welcome materials explain how to start. If you are not sure which questionnaire applies or whether you need scans, contact support.

## Which questionnaire applies

The questionnaire depends on how you take payments. Common examples:

| How you take payments | Typical questionnaire |
|---|---|
| Online, through a hosted checkout page or Payment Links, with no card data on your systems | SAQ A |
| A standalone terminal connected to the internet, with no other devices involved | SAQ B-IP |
| A virtual terminal on one dedicated computer | SAQ C-VT |
| A virtual terminal or payment devices alongside other connected systems | SAQ C |
| Storing card data or more complex setups | SAQ D |

Support will help you confirm the right one.

## Everyday security habits

- **Never store card numbers** on paper, in email, in texts, or in spreadsheets.
- **Never ask customers to email or text card numbers.** Send a [Payment Link](/docs/merchants/payment-links) instead.
- **Give everyone their own login** and only the access they need. Remove users who leave. See [Users and roles](/docs/merchants/merchant-dashboard#users-and-roles).
- **Use strong, unique passwords** for the dashboard and any device that takes payments.
- **Keep terminals, phones, and computers updated.**
- **Check terminals for tampering,** such as loose parts, extra devices, or unexpected wiring.
- **Protect API keys.** Treat them like passwords and replace any key you think was exposed.
- **Use chip or tap** for in-person sales whenever you can.

## If you suspect a problem

If you think card data was exposed or a device was tampered with, stop using it and contact support right away.

## Need help?

Email info@thepoints.io or call (833) 374-1518.