Guide
PCI SAQ A-EP: when your website still affects card payments
PCI SAQ A-EP applies to e-commerce merchants who outsource processing but whose own website can affect the payment page. So your web server sits in scope, even though card data never reaches it.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who needs PCI SAQ A-EP
It fits when your site delivers the payment page or scripts that could alter it. For example, a direct-post integration or a page that loads the provider's script from your own server often lands here. The form is in the PCI SSC document library.
Why the form is much longer than SAQ A
If your site were compromised, an attacker could change the payment page and capture card data. Therefore the form asks you to secure that site properly.
- Network security controls around the web server
- Secure configuration and patching
- Vulnerability scans and testing
- Logging and monitoring of the site
- Script inventory and tamper detection on the payment page
PCI SAQ A-EP readiness check
Tick what your website already has.
Your result appears here as you tick, so you can see what is still open.
PCI SAQ A-EP compared with SAQ A
The difference is your website's role.
| SAQ A | SAQ A-EP | |
|---|---|---|
| Payment page from | The provider entirely. | Your site, at least partly. |
| Your web server in scope | No. | Yes. |
| Length | Short. | Much longer. |
Reducing scope
Moving to a fully hosted payment page or a provider frame can bring you back to SAQ A. So compare the cost of changing checkout with the cost of securing your site to the A-EP standard.
For many smaller shops, changing the checkout integration is the cheaper path. However, it can affect conversion and design, so weigh both before deciding.
Our role with PCI SAQ A-EP
We review the checkout, recommend the cheapest compliant path and prepare the evidence. However, your executive signs the form, and we are not a QSA.
PCI SAQ A-EP questions
Why does PCI SAQ A-EP apply if we never see card numbers?
Because your site could be changed to capture them, so it is in scope.
Can we avoid A-EP?
Often, by moving to a fully hosted page or a provider frame.
Does PCI SAQ A-EP need penetration testing?
Check the current form, because testing requirements apply to some A-EP merchants.
Who signs it?
Your executive.
Related guides
Find the cheapest path for your checkout
Describe your checkout integration. We reply with options and a written estimate.
Get my written estimate