PCI Recommendations and Integration Types
This page outlines the various integration methods and their corresponding PCI DSS Self-Assessment Questionnaire (SAQ) recommendations. If your business processes, transmits, or stores customer card information, maintaining compliance with the Payment Card Industry Data Security Standard (PCI DSS) is critical.
PCI compliance is shared by your organization, Chargebee, and your payment gateway.
Consult a QSA
The suggestions on this page are broad guidelines, so they might not fit every business scenario. The SAQ you need depends on your business operations and your merchant bank's criteria. For more specific guidance, consult your merchant bank, or a Qualified Security Assessor (QSA).
PCI DSS v4.0.1 and SAQ A
For businesses eligible for SAQ A, the PCI Security Standards Council has updated SAQ A's scope, removing PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1—which focus on payment page security—and Requirement 12.3.1, which is related to targeted risk analysis. This modification simplifies compliance requirements for SAQ A merchants.
Chargebee's hosted payment pages
This option entails using Chargebee's hosted checkout to collect the customer's card details. Once the details are collected, the sensitive card information is encrypted and sent to the chosen payment gateway. The processed information from the payment gateway is then sent to Chargebee as a token that is associated with the customer record in Chargebee.
Recommendation: SAQ A compliance
Chargebee.js Payment Components + Chargebee API
With this option, you own and customize/create your own checkout page and use Chargebee.js Payment Components to collect the customer's payment details. Your backend creates a payment intent through the Chargebee API, and the component renders the card fields, along with any other payment methods you enable, inside an iframe served from Chargebee's domain. The customer enters their card details directly into Chargebee's PCI DSS validated environment, so those details never reach your page or your servers. The sensitive card information is encrypted and sent to the chosen payment gateway for authorization. Use the authorized payment intent with the Create subscription and Create payment source APIs to create subscriptions and payment methods in Chargebee.
Recommendation: SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
Any gateway JavaScript + Chargebee API
With this option, you build your own checkout page and use the JavaScript your payment gateway provides to collect the card data. After the customer enters the card details, the sensitive card information is encrypted and sent to the payment gateway. The gateway returns a token. Use that token with the Create subscription and Create payment source APIs to create subscriptions and payment methods in Chargebee.
Recommendation: SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
Card data collection on your website + Chargebee API
In this option, you collect the card details and process them in one of these ways:
-
Transmit the card details to Chargebee, which encrypts them and routes them to the chosen payment gateway.
-
Transfer the card details directly to the chosen payment gateway. The gateway returns a token. Use that token with the Create subscription and Create payment source APIs to create subscriptions and payment methods in Chargebee.
Recommendation: SAQ D compliance
Checkout Providers + Chargebee API
With this option, you offer customers a checkout experience from a third-party checkout provider. On completion of a transaction, you can collect the token created in your chosen gateway account and use the Chargebee SDK (with the language of your preference) to create subscriptions and payment methods in Chargebee.
Recommendation: SAQ A compliance
Chargebee.js Card Components + Chargebee API
Card Components are deprecated. Existing integrations continue to work without interruption, but for new integrations, use Payment Components, which cover cards and every other payment method you enable in a single integration.
With this option, you build your own checkout page and use Chargebee.js Card Components to collect the card details. After the customer enters the card details, request a Chargebee token and send it to your server. Use that token with the Create subscription API or the Create a payment source using a Chargebee token API to create subscriptions and payment methods in Chargebee.
Recommendation: SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
These suggestions serve as broad guidelines and may not suit every unique business situation. Your required Self-Assessment Questionnaire (SAQ) depends on your business operations and your merchant bank's criteria. For precise guidance, we advise consulting your merchant bank or an accredited PCI-DSS assessor directly.