PCI SAQ A self-check
Ten questions to bring to a payment provider, a QSA, or your own ops team. This is a conversation aid, not an audit or legal advice.
- Are card number, expiry, and CVV fields inside a payment-provider iframe or hosted fields?
- Does your server ever receive raw card data, even transiently?
- Is checkout served over HTTPS with no mixed-content warnings?
- Can you name every third-party script that runs on the checkout page?
- Can you list every payment provider and integration in the card flow?
- Do you have a current network diagram for the checkout path?
- Who owns the annual SAQ A form — finance, engineering, or an agency?
- What evidence did your processor or bank ask for last year?
- Does a new storefront or payment method reopen the scope?
- Do you have a one-page answer for “where does card data go?”
If you answer “no” to 1–3, the payment page may be outside the simplest SAQ A shape. Scope Lens can show you what the page actually loads; it does not store or transmit page data.