An SAQ (Self-Assessment Questionnaire) is the PCI DSS self-assessment form. The merchant fills it in, but its size depends on how payments are accepted: if card details are entered on the certified provider side, the merchant gets the shortest version.
What drives the size
- Card data is entered on the provider page — the assessed scope is minimal.
- The form is embedded into the merchant site — more questions and stricter site requirements.
- The merchant accepts and stores details themselves — that is full certification, not a questionnaire.
What is required either way
- A valid HTTPS certificate on the site.
- No card data in logs, emails or messengers.
- Limited employee access to payment data and keys.
What PCI DSS is and what provider certification gives you is covered separately.
