PCI Recommendations and Integration Types
This page outlines the various integration methods and their corresponding PCI DSS Self-Assessment Questionnaire (SAQ) recommendations. If your business processes, transmits, or stores customer card information, maintaining compliance with the Payment Card Industry Data Security Standard (PCI DSS) is critical.
Chargebee helps ease the burden of PCI compliance, but it's important to remember that compliance is a shared responsibility between your organization, Chargebee, and your payment gateway.
Consult a QSA
The suggestions on this page are broad guidelines, so they might not fit every business scenario. The SAQ you need depends on your business operations and your merchant bank's criteria. For more specific guidance, consult your merchant bank, or a Qualified Security Assessor (QSA).
PCI DSS v4.0.1 and SAQ A
For businesses eligible for SAQ A, the PCI Security Standards Council has updated SAQ A's scope, removing PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1—which focus on payment page security—and Requirement 12.3.1, which is related to targeted risk analysis. This modification simplifies compliance requirements for SAQ A merchants.
Chargebee's hosted payment pages
This option entails using Chargebee's hosted checkout to collect the customer's card details. Once the details are collected, the sensitive card information is encrypted and sent to the chosen payment gateway. The processed information from the payment gateway is then sent to Chargebee as a token that is associated with the customer record in Chargebee.
Recommendation- SAQ A compliance
Chargebee.js Payment Components + Chargebee API
With this option, you own and customize/create your own checkout page and use Chargebee.js Payment Components to collect the customer's payment details. Your backend creates a payment intent through the Chargebee API, and the component renders the card fields, along with any other payment methods you enable, inside an iframe served from Chargebee's domain. The customer enters their card details directly into Chargebee's PCI DSS validated environment, so those details never reach your page or your servers. The sensitive card information is encrypted and sent to the chosen payment gateway for authorization. The authorized payment intent should be used in the ‘Create subscription' and ‘Create payment source' APIs to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
Any gateway JavaScript + Chargebee API
With this option, you will own and customize/create your own Checkout page and use the provision (Java Script) provided/offered by your chosen payment gateway to collect the customer's card data. Once the customer's credit card details are entered on the Checkout page, the sensitive card information is encrypted and sent to the payment gateway. The processed information from the payment gateway is then shared as a Token. The Token should be used in the ‘Create subscription' and ‘Create payment source API' to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
Card data collection on your website + Chargebee API
In this option, you'll have to collect the card details at your end, and process it in the following ways -
-
Transmit the card details to Chargebee, which will then be encrypted and routed to the chosen payment gateway.
-
Directly transfer the card details to the chosen payment gateway for processing. The processed information from the payment gateway is then shared as a token. The token should be used in the ‘Create subscription' and ‘Create payment source API' to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ D compliance
Checkout Providers + Chargebee API
With this option, you get to offer your customers a checkout experience offered by a third-party ‘Checkout' service provider. On completion of a transaction, you can collect the token created in your chosen gateway account and use the Chargebee SDK (with the language of your preference) to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
Chargebee.js Card Components + Chargebee API
Note
Card Components are deprecated. Existing integrations continue to work without interruption, but for new integrations, use Payment Components, which cover cards and every other payment method you enable in a single integration.
With this option, you will own and customize/create your own checkout page and use Chargebee.js Card Components to collect customer's card details. Once the customer's credit card details are entered in the Hosted Payment Fields or Components, the sensitive card information is encrypted and sent to the chosen payment gateway. The processed information from the payment gateway is then sent to Chargebee as a Token. The Token should be used in the ‘Create subscription' and ‘Create payment source API' to create subscriptions and payment methods in Chargebee.
Recommendation- SAQ A compliance
Security Considerations
Incorporating scripts from external sources means your site's security depends on their safeguards, which can increase risk. If those external providers are ever breached, unauthorized code could potentially run on your pages. Many websites still depend on external scripts for services like analytics. We recommend limiting their usage whenever you can.
Note
These suggestions serve as broad guidelines and may not suit every unique business situation. Your required Self-Assessment Questionnaire (SAQ) depends on your business operations and your merchant bank's criteria. For precise guidance, we advise consulting your merchant bank or an accredited PCI-DSS assessor directly.
Articles & FAQs
Was this article helpful?