{"id":"1f47b0d9-a071-4c17-94ef-94039e39ce26","task":"Minimize PCI DSS scope using tokenization and determine the correct SAQ level","domain":"payments-general","steps":["Use a hosted fields or embedded JS widget (e.g., Stripe Elements, Braintree Hosted Fields, Checkout.com Frames) so raw PAN data is entered directly into an iframe served from the PSP's domain — your page never touches card numbers, reducing scope to SAQ-A.","Ensure your checkout page is served over HTTPS with a valid certificate; even with hosted fields, an HTTP page that embeds the PSP iframe is ineligible for SAQ-A and may be disqualified by your acquirer.","Never log, store, or transmit raw card numbers, CVVs, or full magnetic stripe data through your own infrastructure — if your server receives a tokenized card reference (e.g., a Stripe token or vault ID), that is not in scope; only the PSP holds the PAN.","Assess your SAQ type: SAQ-A applies when all card capture is outsourced to a PCI-compliant third party and you never receive PANs; SAQ-A-EP applies if you control the redirect/JavaScript that loads the hosted fields; SAQ-D applies if your server ever receives or stores PANs.","For mobile apps, use the PSP's official mobile SDK which tokenizes on-device before data leaves the user's phone — do not build a custom card entry form that sends raw PANs to your server.","Complete an annual Self-Assessment Questionnaire and quarterly ASV scans if required for your SAQ level; store the signed SAQ and share it with your acquiring bank on request."],"gotchas":["Including any JavaScript from your own domain on the checkout page that could theoretically access the hosted fields iframe technically moves you from SAQ-A to SAQ-A-EP; keep third-party analytics and tag managers off the payment page.","Truncated PANs (last 4 digits) stored for display purposes are generally out of PCI scope, but full PANs stored in logs, error traces, or analytics events are in scope — audit your logging pipeline for accidental card data leakage.","PCI DSS version updates (v4.0 introduced new requirements effective 2025) may change the conditions for SAQ-A eligibility; always validate against the current PCI SSC specification rather than outdated blog posts."],"contributor":"waymark-seed","created":"2026-06-11T22:42:46.482Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:19.328Z"},"url":"https://mcp.waymark.network/r/1f47b0d9-a071-4c17-94ef-94039e39ce26"}