Braintree PCI Compliance: Which SAQ Applies and When You Need an ASV Scan
Braintree PCI compliance explained: see which SAQ fits Hosted Fields, Drop-in or custom builds, and when quarterly ASV scans apply. Book an ASV scan today.
• PCI ASV certification belongs to the scanning vendor, not to you. It is a qualification the PCI Security Standards Council (PCI SSC) gives to companies that may run external scans for PCI DSS.
• "PCI certified" has no official meaning for merchants. The PCI SSC does not certify businesses, so always ask which program a vendor means.
• "PCI compliant" is your status. You validate it with a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC), plus an Attestation of Compliance (AOC).
• ASV approved means the vendor's scans count. Quarterly external scans under Requirement 11.3.2 must come from an Approved Scanning Vendor.
• A passing scan is evidence, not proof. It supports your compliance but does not replace the rest of PCI DSS.
• Verify before you buy. Check any vendor against the PCI SSC's official lists.
PCI ASV certification is one of the most misunderstood labels in payment security, and mixing it up with “PCI certified” or “PCI compliant” can get a scan report rejected by your acquirer. The three terms sound alike, but each describes a different party, a different process and a different level of proof.
The confusion is easy to understand. The PCI ecosystem is full of overlapping acronyms, and many vendors use “certified” loosely in their marketing. The practical risk is real: a merchant who buys a scan from a company that is not on the PCI SSC’s list may have to repeat the scan with an approved vendor before their validation can move forward.
This guide separates the terms, shows who validates what, and gives you a short routine for checking a vendor’s claim. It is written for SMB owners, IT managers and security leads who need to meet their scanning obligations without wading through standards language. For the programme rules behind it, see our PCI Approved Scanning Vendor programme guide.
PCI SSC (PCI Security Standards Council): the body that publishes PCI DSS and runs programs for assessors, scanning vendors and validated products. It does not enforce compliance.
PCI DSS: the Payment Card Industry Data Security Standard, the security requirements for anyone who stores, processes or transmits cardholder data.
PCI ASV certification: the colloquial name for a scanning company's qualification and listing under the PCI SSC's ASV programme. It applies to the vendor, never to the merchant being scanned.
ASV (Approved Scanning Vendor): a company the PCI SSC has qualified to run external vulnerability scans for PCI DSS Requirement 11.3.2.
QSA (Qualified Security Assessor): a company the PCI SSC has qualified to assess PCI DSS compliance and produce an ROC.
AOC (Attestation of Compliance): the signed declaration of your validation status, submitted to your acquirer or card brand.
ASC (Attestation of Scan Compliance): the document an ASV issues with a passing scan report.
PCI ASV certification is a program-specific qualification the PCI SSC gives to scanning vendors. It is not a merchant credential, a software feature, or a title a vendor can award itself.
To appear on the PCI SSC’s ASV list, a scanning company has to meet the qualification requirements in the ASV Program Guide, including having its scanning solution tested, and it has to stay in good standing to remain listed. The legitimacy of a scan therefore comes from the vendor’s standing, not from how impressive the scanner looks.
That is why PCI ASV certification is a property of the vendor and not of your business. You never receive an “ASV certificate. “You receive a scan report and, when you pass, an Attestation of Scan Compliance from your ASV.
Many security tools offer useful vulnerability scanning without being approved for PCI purposes. Those scans are good for hygiene, but they will not satisfy the external scanning requirement. Our explainer on what an ASV scan is covers what the scan itself does.
Run your quarterly external scan and receive a report built for your acquirer.
"PCI certified vendors" is not one uniform group. It loosely refers to companies recognized under different PCI SSC programs, such as ASVs, QSAs and listed P2PE solution providers, and each recognition covers only its own role.
The PCI SSC runs several separate programmes. QSA companies are qualified to assess compliance. ASVs are qualified to run external scans. Other programmes list validated products and solutions, such as PIN transaction security devices and P2PE solutions. A company recognised in one programme has no automatic standing in another.
This matters when you are sourcing scans. A QSA is not necessarily an ASV, and an ASV is not necessarily a QSA. A vendor that says it is “PCI certified” might mean either or neither.
The label also says nothing about whether the vendor’s own systems are secure, and it says nothing about your compliance. When you hear it, ask which programme the vendor means and where it is listed. Our guide to approved scanning vendors explains how to read those lists.
"PCI certified" describes a vendor's or product's standing under a PCI SSC program. "PCI compliant" describes a merchant's or service provider's validated adherence to PCI DSS. They apply to different parties.
The PCI SSC does not certify merchants, so there is no official “PCI certified merchant” status. What you hold is a validated compliance status, and you maintain it as an ongoing state rather than a one-time award.
Your acquirer or card brand decides how you validate. Most merchants complete the SAQ that matches how they take payments and sign an AOC, while larger merchants and many service providers work with a QSA to produce a ROC. Our guide to SAQ types shows how to identify yours.
Here is how the three terms compare:
Term | Applies to | Who grants or validates it | What it tells you |
|---|---|---|---|
PCI certified | Used loosely; officially products or qualified companies | PCI SSC programs | Depends on the claim, so ask which program |
PCI compliant | Merchants and service providers | You (SAQ plus AOC) or a QSA (ROC plus AOC) | You have validated the requirements that apply to you |
ASV approved | Scanning vendors | PCI SSC qualification and listing | The vendor can issue scans that count for Requirement 11.3.2 |
The distinction between the roles is also why scanning and assessing are separate jobs. We explain how they fit together in an ASV scan vs. a QSA.
ASV approved means the PCI SSC has qualified the vendor to run external scans that count toward PCI DSS Requirement 11.3.2. Only scans from an approved vendor will be accepted as evidence of that requirement.
In practice, ASV-approved has three consequences for you:
• Your quarterly external scans must come from an ASV, and a scan from a non-ASV tool does not satisfy the requirement.
• The report must follow the programme’s format and show a passing result, with an Attestation of Scan Compliance from the ASV.
• Being ASV approved says nothing about whether your own environment passes.
The moment this matters most is when you submit evidence to your acquirer. A report from a vendor that is not listed can be rejected, however thorough the scan was. Our article on ASV report acquirer acceptance covers what acquirers look for, and what an ASV report is walks through its sections.
Compare pricing by scan scope before you commit to a vendor.
Where your validation requires external scanning, PCI DSS Requirement 11.3.2 calls for scans at least every three months by a PCI approved scanning vendor, with rescans until you pass.
Whether scanning applies to you depends on your SAQ type and your acquirer’s rules. If it applies, three points matter:
1. Cadence. Scans run at least once every three months, and a pass from a year ago does not cover today. Our guide to how often you need an ASV scan covers timing.
2. Scope. The scan covers your internet-facing systems that are in scope. See PCI ASV scan requirements for what to include.
3. Pass criteria. A scan passes when it has no vulnerabilities rated 4.0 or higher on the CVSS base scale and no automatic failures. Our explainer on the ASV scan passing score clears up the common confusion with CVSS version 4.0.
If you are comparing SAQ types, SAQ A vs SAQ D scan requirements show how scanning obligations differ. For small teams, the practical challenge is finding a vendor that is both genuinely listed and easy to work with. Our checklist on how to choose an ASV vendor helps you weigh that. Secusy is an Approved Scanning Vendor, and you should confirm our listing yourself on the PCI SSC’s website, as you would with any provider.
No. A passing ASV scan satisfies the external scanning requirement only. You still need the other applicable PCI DSS controls and a completed SAQ or ROC.
PCI DSS has 12 principal requirements covering network security, data protection, access control, monitoring and policy. External scanning is one control inside that framework. A pass shows that, within the scope you defined, the scan found nothing at or above the failing threshold and no automatic failures.
It does not cover your internal network, application logic or anything left out of scope. Treat the report as one document in your evidence file, alongside your SAQ or ROC. For a deeper look at what a pass does and does not prove, read does a passing ASV scan mean you’re secure, and for the requirement itself, see PCI DSS 11.3.2 explained.
Look up the vendor's legal name on the PCI SSC's official ASV list. If it is not listed, its scans will not satisfy Requirement 11.3.2.
Use this routine before you sign:
1. Ask what they mean. “PCI certified” could mean ASV, QSA, a validated product or nothing official.
2. Look them up. Search the company name on the PCI SSC’s website, in the list that matches the claim.
3. Match the legal entity. Confirm the listed company is the one you are contracting with, not a look-alike.
4. Check the report format. An ASV report should include the Attestation of Scan Compliance.
5. Confirm acceptance. Ask your acquirer whether they have extra requirements for scan evidence.
Resellers can legitimately sell ASV scans, but the scans must be performed and issued under an approved vendor. Ask who the ASV of record is. If a vendor cannot point to its listing, treat that as a red flag.
Three terms, three different questions. PCI ASV certification tells you whether a vendor may run scans that count. “PCI compliant” tells you whether a merchant has validated its own controls. “PCI certified” tells you very little until someone names the program behind it.
For most merchants the action is simple: confirm any scanning vendor against the PCI SSC’s list, keep scanning on a quarterly rhythm, and treat each passing report as one piece of a wider compliance programme. Confirm your validation route with your acquirer, because they set the final rules.
Use our checklist to verify approval status and avoid rejected scan reports.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.