PCI Compliance for PayPal Merchants: Full SAQ Guide 2026
PCI compliance for PayPal merchants explained: which SAQ you need, when ASV scans apply, and how the 2026 PCI DSS v4.0.1 rules changed eligibility.
Search for “best PCI compliance provider”, and the results won’t agree with each other. One list is full of audit firms. Another is entirely software platforms. A third is nothing but vulnerability-scanning companies. That’s not a sign of bad search results; it’s a sign that “PCI compliance provider” is a category people talk about as if it’s one thing, when it’s actually three different jobs that happen to share a compliance standard.
That confusion costs SaaS companies real time. Teams end up evaluating a GRC platform against a QSA firm as if they’re interchangeable, or they sign with an audit firm and are surprised to learn it doesn’t cover their quarterly external scan. Meanwhile, PCI DSS itself doesn’t care how confused the vendor landscape is; if your platform touches cardholder data, you’re in scope, and the requirements apply whether you’ve sorted out which provider does what or not.
This guide breaks the market down by what each type of provider actually does, explains the SaaS-specific wrinkles that generic PCI guidance tends to skip over, and walks through how to decide which providers you actually need at your current stage, starting with the one requirement every SaaS company handling card data has to satisfy regardless of size: the quarterly ASV scan.
PCI DSS (Payment Card Industry Data Security Standard): The global security standard maintained by the PCI Security Standards Council (PCI SSC) that sets requirements for protecting cardholder data during processing, storage, and transmission. Compliance is mandatory for any entity that stores, processes, or transmits payment card data.
ASV (Approved Scanning Vendor): A company on the PCI SSC's official approved-vendor list, authorized to run the external vulnerability scans required quarterly under PCI DSS Requirement 11.3. Only scans run by a listed ASV count toward compliance; a generic vulnerability scanner, however capable, does not satisfy this requirement.
QSA (Qualified Security Assessor): A firm certified by the PCI SSC to conduct formal PCI DSS assessments and issue a Report on Compliance (ROC), typically required once transaction volume or a specific merchant/service provider level triggers it.
GRC Platform (Governance, Risk, and Compliance): Software that automates evidence collection and control monitoring across multiple frameworks (PCI DSS, SOC 2, and ISO 27001, usually from a single dashboard connected to your cloud stack.
Cardholder Data Environment (CDE): The people, processes, and technology that store, process, or transmit cardholder data, plus any systems connected to or capable of affecting the security of those components. Scoping the CDE correctly is one of the most consequential exercises in any PCI programme.
Shared Responsibility Model: The division of security controls between your cloud infrastructure provider (AWS, GCP, Azure) and your own platform. The infrastructure layer being PCI-compliant does not make your application layer compliant, that part stays on you.
Any SaaS platform that stores, processes, or transmits payment card data, or serves merchants who do, is in scope for PCI DSS, with the exact obligations scaling based on transaction volume and how the platform is architected.
There’s a persistent misconception that PCI DSS is a retail problem, something that applies to point-of-sale systems and payment gateways but not to SaaS products. That assumption has burnt plenty of SaaS companies who found out otherwise during an enterprise security review. If your platform handles subscription billing, supports in-app purchases, or passes card data through an API at any point, even briefly, even if you never store it, you have compliance obligations. Which Self-Assessment Questionnaire applies, whether a QSA-led assessment is required, and how often ASV scans are needed all depend on your specific setup and volume.
The commercial stakes are usually what get a compliance programme moving. Enterprise buyers routinely ask for proof of PCI DSS compliance as a vendor qualification step, and a missing Attestation of Compliance or a failed scan can stall a deal that’s otherwise ready to close. Beyond that, non-compliance carries card-brand fines and breach liability that are considerably more expensive than the compliance work itself.
Card-not-present transactions, the default for basically every SaaS product, carry more inherent fraud risk than card-present ones, which is part of why scrutiny on SaaS platforms has increased. And subscription billing, where card details are stored and charged regularly without the customer re-entering anything, creates an ongoing data-security obligation rather than a one-time checkbox. That’s the environment a compliance provider needs to actually understand.
Secusy ASV is a PCI SSC-approved scanning vendor built for SaaS and cloud-native teams, transparent pricing, no rescan fees, and findings your engineering team can act on without a translator.
SaaS companies choose between QSA/audit firms for formal assessments, GRC platforms for cross-framework evidence automation, and ASV scanning specialists for the mandatory quarterly external scan, and most companies past the early stages end up using more than one at once.
Category | What it actually does | Examples | What it doesn’t do |
|---|---|---|---|
QSA / Audit firms | Formal on-site or remote assessments; issues the Report on Compliance for higher-volume merchants and service providers | Firms such as Coalfire, Schellman, and NCC Group, several with cloud-first, SaaS-specific track records | Doesn’t run your quarterly ASV scans, that’s a separate, mandatory requirement </td |
GRC / compliance automation platforms | Pulls evidence automatically from your cloud stack and manages PCI DSS alongside SOC 2, ISO 27001, and similar frameworks in one dashboard | Platforms like Vanta, Drata, and Sprinto, commonly used by SaaS teams pursuing PCI DSS and SOC 2 together | Usually still requires a separate PCI SSC-approved ASV for the actual external scan |
ASV scanning specialists | Runs the PCI SSC-mandated quarterly external vulnerability scan and issues the Attestation of Scan Compliance | Established players include Qualys and SecurityMetrics; Secusy ASV is built specifically for SMB and growth-stage SaaS pricing and turnaround | Doesn’t replace a full QSA assessment for companies that need one |
The mistake most teams make is treating this as a single vendor decision, picking “a PCI provider” the way they’d pick a payroll system. In practice, you’re usually assembling a small stack: maybe a GRC platform for evidence automation, definitely an ASV for the scan, and a QSA only once volume or a customer requirement makes one necessary.
The strongest PCI compliance providers for SaaS companies offer continuous monitoring rather than point-in-time assessments, automated evidence collection, SaaS-specific scoping expertise, and, where scanning is involved, verified PCI SSC approval.
The traditional approach treats PCI DSS as a once-a-year exercise: gather evidence, file the SAQ or complete the QSA assessment, submit the Attestation of Compliance, and revisit it twelve months later. For SaaS companies shipping to cloud infrastructure continuously, that model leaves gaps. A provider offering continuous monitoring surfaces drift before it becomes a finding, instead of discovering it during the next annual scramble.
Gathering logs, configuration records, access control evidence, and scan results by hand is one of the biggest time sinks in any compliance programme. Providers that connect natively to your cloud infrastructure and automate this collection cut down on manual work and reduce the chance that your documentation is a rushed snapshot rather than an accurate picture of your systems.
Scoping is where programmes succeed or fail. A provider unfamiliar with SaaS architecture will either overscope, creating compliance overhead that doesn't need to exist, or underscope, leaving real gaps unaddressed. You want a provider that can accurately map your CDE, separate what's your responsibility from what belongs to your cloud host, and match requirements to your actual transaction flows.
Not every vulnerability scanning tool qualifies as an Approved Scanning Vendor under PCI DSS Requirement 11.3. If a provider's scan results don't come from a PCI SSC-approved ASV, they don't satisfy the requirement, no matter how thorough the scan looks. This is worth verifying directly against the PCI SSC's published vendor list rather than taking a vendor's word for it.
ASV scans are a mandatory, recurring requirement for SaaS companies with internet-facing systems in scope, and only scans run by a PCI SSC-approved vendor count, making the ASV decision one of the few PCI choices every SaaS company handling card data has to make, regardless of size.
Requirement 11.3 of PCI DSS v4.0 calls for external vulnerability scans of all internet-facing systems within or connected to the CDE, at minimum quarterly, and again after any significant change to the environment. For a SaaS platform, that typically covers application servers, API endpoints, and load balancers, anything internet-facing that touches the CDE. The scans must come from a PCI SSC-approved ASV and must either pass or have identified vulnerabilities formally documented and remediated before compliance can be attested.
This has a very practical implication for SaaS teams specifically: if your deployment pipeline pushes to production frequently, each significant change technically triggers a new scan requirement. A provider whose scanning process is built for that pace, integrates with CI/CD or infrastructure tooling, returns results quickly, and doesn’t charge extra for rescans after remediation isn’t a nice-to-have. It’s what keeps compliance from becoming a drag on your release cadence.
There’s a commercial dimension too. Enterprise customers and QSAs reviewing your compliance documentation look closely at scan results. Clean, passing scans from a recognized, approved vendor read as independent validation of your external security posture. Gaps in scan history, failing results, or scans from a non-approved vendor are the kind of thing that gets flagged immediately in a vendor security review.
Secusy ASV is a PCI SSC-approved scanning vendor built for SaaS and cloud-native teams, with transparent pricing, no rescan fees, and reports your engineering team can actually use.
Multi-tenancy, cloud-native infrastructure, API-based payments, and subscription billing each introduce scoping considerations that generic PCI guidance doesn't fully cover, which is why SaaS-specific expertise in a provider matters more than it might seem.
Serving multiple customers from shared infrastructure means demonstrating that one tenant's cardholder data can't be accessed or affected by another tenant's environment. That's a logical-separation question, and it needs to be both robust and documentable. A provider should know how to assess and present evidence of tenant isolation in a way that satisfies a QSA or an enterprise customer's own supplier review.
Most SaaS companies run on AWS, Google Cloud, or Azure, each of which maintains its own PCI DSS compliance at the infrastructure layer. That compliance doesn't extend to your application layer, your data handling, or your access controls, those stay your responsibility. SaaS companies commonly underestimate how much of the PCI DSS control set remains on their side even inside a fully compliant cloud environment. A good provider maps your architecture against your cloud host's published shared-responsibility boundaries and helps close what's left on your side.
Recurring billing usually means storing payment credentials for future charges. PCI DSS puts strict requirements on storing Primary Account Numbers, and storing sensitive authentication data after authorization is prohibited outright. Most SaaS companies sidestep this by tokenizing, swapping the actual card number for a non-sensitive token managed by their processor or vault provider. A provider worth working with will confirm your tokenization setup is scoped correctly, that your vault provider's compliance responsibilities are reflected accurately in your contracts, and that your SAQ reflects the reduced scope tokenization actually earns you.
Most early-stage and growth-stage SaaS companies only need an ASV for the quarterly scan plus a Self-Assessment Questionnaire; formal QSA assessments and GRC platforms become relevant once transaction volume, enterprise sales requirements, or multi-framework compliance enter the picture.
If you’re processing payments through Stripe or a similar processor at moderate volume, you likely fall into a PCI level that only requires an SAQ rather than a full QSA-led assessment. In that scenario, the ASV scan is the one non-negotiable piece, everything else is a question of how much automation or audit support you want layered on top of it.
As the company grows, particularly once enterprise procurement starts asking for a compliance report or you’re pursuing PCI DSS alongside SOC 2, a GRC platform or QSA relationship starts to make more sense. But neither one ever replaces the ASV requirement. It sits alongside them, not underneath them.
Choose a QSA or GRC platform based on your compliance maturity and whether you need multi-framework support, and choose your ASV based on PCI SSC approval status, cloud-native scanning experience, and whether rescans after remediation are included without extra fees.
Verify it against the published list rather than a vendor's own claim. This isn't optional, an unapproved vendor's scan results simply don't satisfy Requirement 11.3.
Many established compliance firms built their processes around on-premise environments and haven't fully adapted to API-driven, multi-tenant architectures. Ask directly how many SaaS companies they currently support and whether they know your specific cloud provider's shared-responsibility model.
Manual compliance work doesn't scale. Check whether the platform connects to your cloud infrastructure, IAM tools, ticketing system, and CI/CD pipeline.
Some vendors bill separately for rescans after remediation, which turns a routine fix into an unplanned cost. Look for this explicitly in pricing.
Findings that come back in language your engineering team can act on, without needing a translator, save real time during remediation.
Enterprise-grade compliance platforms are often priced for enterprise budgets. For SMB and mid-market SaaS teams, transparent, predictable pricing that scales with actual usage matters more than a feature list built for a much larger company.
“Best PCI compliance provider” depends entirely on which job you’re hiring for. QSA and audit firms handle formal assessments and issue the Report on Compliance. GRC platforms automate evidence collection across multiple frameworks at once. ASV scanning specialists run the one requirement every SaaS company handling card data must satisfy every quarter, regardless of size or which other providers are already in the mix. Start by getting the ASV piece right, since it’s mandatory, recurring, and non-substitutable, then layer in a QSA or GRC platform as transaction volume, enterprise requirements, or multi-framework compliance makes that necessary.
PCI compliance for SaaS isn't a single vendor decision. It's the ASV scan (mandatory, every quarter, PCI SSC-approved vendor only) plus, depending on your stage, an SAQ, a QSA assessment, and/or a GRC platform. Get the non-negotiable piece – the scan locked down first – from a vendor built for cloud-native architecture, and build the rest of your compliance stack around it as you grow.
Secusy ASV is listed as a PCI SSC-approved Approved Scanning Vendor and built specifically for how SaaS and cloud-native teams operate, fast turnaround, transparent SMB-friendly pricing, no rescan fees, and results your engineering team can act on without translation.
No. GRC platforms automate evidence collection and control monitoring, but the quarterly external vulnerability scan required under PCI DSS Requirement 11.3 must be performed by a PCI SSC-listed Approved Scanning Vendor, something most GRC platforms don't provide directly.
At minimum quarterly, and again after any significant change to the cardholder data environment. Because SaaS deployment pipelines often push production changes frequently, a scanning provider that can turn around fast, CI/CD-friendly scans matters more here than it would for a traditional retail environment.
No. Cloud providers maintain their own PCI DSS compliance at the infrastructure layer, but that doesn't extend to your application layer, data handling practices, or access controls, those remain your responsibility under the shared responsibility model.
A failed scan means identified vulnerabilities need to be remediated and the affected systems rescanned before compliance can be attested. Ask prospective ASV vendors upfront whether rescans after remediation are included in pricing or billed separately, this is a common hidden cost.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.