This page outlines the various integration methods and their corresponding PCI DSS Self-Assessment Questionnaire (SAQ) recommendations. If your business processes, transmits, or stores customer card information, maintaining compliance with the Payment Card Industry Data Security Standard (PCI DSS) is critical.
Chargebee helps ease the burden of PCI compliance, but it's important to remember that compliance is a shared responsibility between your organization, Chargebee, and your payment gateway.
Consult a QSA
The suggestions on this page are broad guidelines, so they might not fit every business scenario. The SAQ you need depends on your business operations and your merchant bank's criteria. For more specific guidance, consult your merchant bank, or a Qualified Security Assessor (QSA).
PCI DSS v4.0.1 and SAQ A
For businesses eligible for SAQ A, the PCI Security Standards Council has updated SAQ A's scope, removing PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1—which focus on payment page security—and Requirement 12.3.1, which is related to targeted risk analysis. This modification simplifies compliance requirements for SAQ A merchants.
With this option, you get to offer your customers a native out-of-the-box (OOTB) experience provided by Chargebee to collect the customer's card details. Once the details are collected, the sensitive card information is encrypted and sent to the chosen payment gateway. The processed information from the payment gateway is then sent to Chargebee as a token that is associated with the customer record in Chargebee.
Recommendation- SAQ A compliance
With this option, you will own and customize/create your own checkout page and use Chargebee.js Card Components to collect customer's card details. Once the customer's credit card details are entered in the Hosted Payment Fields or Components, the sensitive card information is encrypted and sent to the chosen payment gateway. The processed information from the payment gateway is then sent to Chargebee as a Token. The Token should be used in the ‘Create subscription' and ‘Create payment source API' to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
With this option, you will own and customize/create your own Checkout page and use the provision (Java Script) provided/offered by your chosen payment gateway to collect the customer's card data. Once the customer's credit card details are entered on the Checkout page, the sensitive card information is encrypted and sent to the payment gateway. The processed information from the payment gateway is then shared as a Token. The Token should be used in the ‘Create subscription' and ‘Create payment source API' to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
In this option, you'll have to collect the card details at your end, and process it in the following ways -
Transmit the card details to Chargebee, which will then be encrypted and routed to the chosen payment gateway.
Directly transfer the card details to the chosen payment gateway for processing. The processed information from the payment gateway is then shared as a token. The token should be used in the ‘Create subscription' and ‘Create payment source API' to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ D compliance
With this option, you get to offer your customers a checkout experience offered by a third-party ‘Checkout' service provider. On completion of a transaction, you can collect the token created in your chosen gateway account and use the Chargebee SDK (with the language of your preference) to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
These suggestions serve as broad guidelines and may not suit every unique business situation. Your required Self-Assessment Questionnaire (SAQ) depends on your business operations and your merchant bank's criteria. For precise guidance, we advise consulting your merchant bank or an accredited PCI-DSS assessor directly.
Was this article helpful?