Glossary
PCI DSS
PCI DSS is the security standard of the card schemes, maintained by the PCI Security Standards Council, for every organisation that stores, processes or transmits card data: merchants, service providers, processors. It sets requirements on networks, encryption, access control, logging, testing and policies; compliance is shown by a self-assessment questionnaire or an on-site assessment, depending on volume and role. Scope is the whole game: a hosted checkout and a vault keep card numbers away from the merchant's and the business's own systems.
Levels and questionnaires
Merchants are levelled by transaction volume; the smallest fill in a self-assessment questionnaire, the largest are assessed on site. Which questionnaire applies depends on how card data is handled: a merchant that redirects to a hosted page fills in the shortest one; a merchant with payment fields on its own page a longer one; a merchant that touches card numbers the full one. Service providers that process cards for others have their own, heavier requirements.
Version 4 and payment pages
The current version adds requirements for the payment page itself: an inventory of its scripts with their justification and integrity, and a mechanism that detects unauthorised changes to the page and its headers, against skimming attacks. A hosted checkout that meets them spares every merchant on it from building them.
On the platform
Tranzify’s hosted checkout and vault are built to the standard’s requirements for service providers: the card number travels from the payer’s browser to the vault and nowhere else, the checkout loads no third-party scripts except the Google Pay library and checks its own integrity and headers on every release, keys live in a managed service, and the compliance documents are shared with clients at contract stage. The platform claims no certificate; the scope of what has been assessed is stated in those documents.
Updated: 2026-11-08