The Payment Card Industry Data Security Standard (PCI DSS) is a set of industry-mandated requirements for any business that handles, processes, or stores credit cards – regardless of the business's size or location. The PCI Security Standards Council was founded by 5 of the major card brands, and they each share equal responsibilities in the council's work. Read more about PCI compliance on the PCI Security Standards Council's website.
You must fill out a Self-Assessment Questionnaire (SAQ) annually to help you determine if your payment processing setup is PCI compliant. The SAQ includes a series of yes-or-no questions for each applicable PCI DSS requirement.
Your PCI compliance level and how you integrate with Braintree will determine which SAQ you should complete. Read more about the different SAQs.
There are four levels of PCI compliance that indicate your level of risk and exposure. In their role as part of the PCI Security Standards Council, Visa determines how to classify your business by looking at your Visa transaction volume over a 12-month period. This transaction volume is based on the aggregate number of Visa transactions (inclusive of credit, debit, and prepaid cards) from your registered Doing Business As (DBA) name. Merchants with the highest transaction volumes are classified as level 1, while those with the lowest transaction volumes are level 4. You can find more information about PCI levels on Visa's website.
Although Braintree securely stores and processes card data for you, integrating with Braintree does not automatically fulfill your PCI compliance requirements. You are still required to complete an annual SAQ in order to be PCI compliant.
PCI compliance may seem overwhelming, but there are resources to help. Qualified Security Assessors (QSAs) are independent security individuals and organizations that have been qualified by the PCI Security Standards Council to validate an entity’s adherence to the PCI DSS. A QSA can help you choose the right SAQ for your business and support you through the process.
We’ve partnered with SecurityMetrics, a QSA company, to offer PCI compliance assistance to our merchants. Within 30 days of signing up with Braintree, you'll receive an email explaining how to create your account with SecurityMetrics, if you choose to use them for PCI assistance.
If you are using Braintree Direct and your business falls into level 3 or 4 of PCI compliance, we’ll set you up with SecurityMetrics at no cost to you. Due to the increased scope of compliance, level 1 and 2 merchants who choose to partner with SecurityMetrics will be subject to any enterprise-level account fees assessed by SecurityMetrics.
To take advantage of SecurityMetrics’ services, you’ll need to wait to enroll until we email you with your Merchant Account Number. The Merchant Account Number needed to enroll with SecurityMetrics is different from your Merchant Account ID and Merchant ID. This value is not displayed in the Control Panel, so if you no longer have the email with this information, you’ll need to email our Support team.
Part of the enrollment process includes answering a brief set of questions that will help them determine which SAQ you need to complete. When you get to that step, take a look at our tips below.
- Navigate to the SecurityMetrics Braintree page
- Click Sign Up and enter the email address associated with your Braintree account
- Verify your email address
- Continue through the wizard and complete the questionnaire about your credit card processing
- When selecting your methods of processing cardholder data, be sure to select only eCommerce if you accept cards exclusively online
- If your Braintree integration uses our Drop-in UI or Hosted Fields, select eCommerce and I accept payments using an iFrame from a 3rd Party Store
- If your developers built a custom UI, select eCommerce and I accept payments through my own website
Still have questions?
If you can’t find an answer, contact our Support team.