The PCI DSS compliance platform built for fintech startups

PCI DSS applies to any organisation that stores, processes, or transmits cardholder data — including card numbers, CVVs, and magnetic stripe data. This includes merchants, payment processors, service providers, and any SaaS company whose product touches payment card data. If your customers' cardholder data passes through your systems in any way, PCI DSS likely applies.

PCI DSS v4.0 organises requirements into 12 groups: (1) Install and maintain network security controls, (2) Apply secure configurations, (3) Protect stored account data, (4) Protect cardholder data in transit, (5) Protect against malicious software, (6) Develop and maintain secure systems, (7) Restrict access by business need, (8) Identify and authenticate users, (9) Restrict physical access, (10) Log and monitor all access, (11) Test security regularly, (12) Support information security with policies. ComplyJet automates evidence collection across all 12.

An SAQ (Self-Assessment Questionnaire) is a self-attestation for organisations with lower transaction volumes or limited CDE scope — completed without an external assessor. A QSA assessment involves a qualified security assessor who validates your controls and issues a Report on Compliance. Which you need depends on your merchant level (determined by annual transaction volumes) and your payment processor requirements.

ComplyJet's platform is $5,000/year for PCI DSS — one flat price for startups up to 50 employees — as you grow from a founding team to 30 or 40 people, your cost stays the same. If you require a formal QSA assessment, assessor fees are separate (typically $15,000–$50,000 depending on scope and merchant level). Required penetration testing and vulnerability scanning are also separate costs. ComplyJet reduces preparation time and assessor back-and-forth significantly.

PCI DSS compliance must be validated annually — either through SAQ submission or a new QSA assessment. You also need quarterly vulnerability scans by an Approved Scanning Vendor (ASV) and annual penetration tests. ComplyJet monitors your controls continuously year-round so annual revalidation is far simpler than the initial compliance build.

Using a payment processor that tokenises cardholder data (like Stripe) significantly reduces your PCI DSS scope — but does not eliminate it entirely. You still need to complete a SAQ (typically SAQ A or SAQ A-EP) and maintain certain baseline controls. The simpler your CDE, the simpler your compliance. ComplyJet helps you understand your scope and meet the requirements that apply.