PCI Compliance

PCI DSS (Payment Card Industry Data Security Standard) is the security framework governing how businesses handle credit card data. Maintained by the PCI Security Standards Council (founded by Visa, Mastercard, Amex, Discover, and JCB), PCI DSS defines technical and operational requirements across 12 categories, including network security, access control, encryption, and monitoring.

PCI compliance levels vary based on transaction volume. Level 1 merchants (over 6 million transactions annually) must undergo annual on-site assessment by a Qualified Security Assessor (QSA). Levels 2-4 can self-assess using a Self-Assessment Questionnaire (SAQ). Most subscription businesses fall into Level 3 or 4, but the specific SAQ type depends on how payment data is handled.

The most effective strategy for subscription businesses is to minimize PCI scope by using a payment processor's hosted or tokenized payment collection. When customers enter card details directly into Stripe Elements, Braintree Drop-in, or Adyen's checkout components, the card data never touches the merchant's servers. This reduces the compliance burden from the comprehensive SAQ D (which has over 300 requirements) to the much simpler SAQ A (around 20 requirements).

PCI DSS version 4.0, which became mandatory in March 2025, introduced significant changes. New requirements include stricter multi-factor authentication, more rigorous vulnerability scanning, and a risk-based approach to security controls. The standard also introduced "customized validation," allowing organizations to meet objectives through alternative controls if they can demonstrate equivalent security.

LostChurn handles payment recovery without ever storing or accessing raw cardholder data. All retry operations use tokenized payment methods through your existing processor's API, keeping your PCI scope unchanged. The platform itself maintains SOC 2 Type II compliance and undergoes regular security assessments to protect your billing data.