PCI DSS for a small café: SAQs and card data basics

Every café that takes cards will sooner or later hear "PCI": in the processor's welcome email, on a monthly statement, or from a sales rep offering to make it go away. It sounds like something for banks and big retailers. It isn't. It applies to a two-person coffee bar too, and most of what it asks of a small café comes down to a few habits.

This is the fourth post in our series on setting up the tech for a new café, after choosing a POS, online ordering and Wi-Fi and network basics.

This is general information, not legal or compliance advice. Your acquirer (the bank or company that processes your card payments) decides what you have to do to show compliance. Ask them, and follow what they tell you.

What PCI DSS is

PCI DSS stands for the Payment Card Industry Data Security Standard. It's published by the PCI Security Standards Council (PCI SSC), whose founding members are the card brands. The Council's merchant page puts it this way:

"PCI DSS is a set of baseline technical and operational requirements designed to protect payment account data. It is intended for all entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD), or could impact the security of CHD and/or SAD." (PCI SSC: Merchant resources)

The same page explains who enforces it: "Each of PCI SSC's founding payment brand members (American Express, Discover, JCB International, MasterCard and Visa) currently have their own PCI compliance programs for the protection of their affiliated payment card account data."

Two terms worth knowing:

Cardholder data is, most importantly, the card number (the Council calls it the PAN, the primary account number).
Sensitive authentication data is, in the Council's words, "used by the issuer of a card to authenticate the card and the cardholder, specifically the card verification code and the PIN/PIN block." It "must not be stored after authorization even if encrypted" (PCI SSC FAQ 1533). In café terms: never write down or keep the three- or four-digit code on a card, or a customer's PIN.

Does it apply to a small café?

Yes. The Council's answer to "Do small merchants with limited transaction volumes need to comply with PCI DSS?" is:

"PCI DSS is intended for all entities involved in payment processing, including merchants, regardless of their size or transaction volume. When compared with larger merchants, small merchants often have simpler environments, with limited amounts of cardholder data and fewer systems that need protecting, which can help reduce their PCI DSS compliance effort."

It goes on: "Whether a small merchant is required to validate compliance is determined by the individual payment brands. For questions regarding compliance validation and reporting requirements, merchants should contact their acquirer (merchant bank) or payment brand they do business with, as applicable" (PCI SSC: Merchant resources).

So there are two separate questions:

Complying: following the standard's requirements that apply to how you take cards. That applies to everyone.
Validating: proving it, in the form your acquirer asks for. That's up to the card brands and your acquirer.

The Council's own small-merchant glossary defines the acquirer: "A MERCHANT BANK is a bank or financial institution that processes credit and/or debit card payments on behalf of merchants. Acquirer, acquiring bank, and card or payment processor are also terms for this entity" (PCI SSC: Common Payment Systems). If your POS company also handles your card processing, ask it directly what it expects from you.

What an SAQ is, and who picks yours

Most small merchants who are asked to validate do it with a Self-Assessment Questionnaire, or SAQ. The Council's FAQ:

"PCI DSS Self-Assessment Questionnaires (SAQs) are validation tools for use by SAQ-eligible merchants and service providers to perform and report the results of their PCI DSS self-assessments. There are several different SAQs, developed for specific types of environments as defined in each SAQ's eligibility criteria." (PCI SSC FAQ 1215)

Why several? Because cafés take cards in different ways. The Council says there are "multiple versions of PCI DSS SAQs to meet various merchant scenarios, depending on how each merchant organization stores, processes, or transmits cardholder data (CHD) and/or sensitive authentication data (SAD)" (PCI SSC FAQ 1133).

At a high level, the questions that decide which SAQ fits are about your setup:

How do cards reach the payment system? A card reader at the counter, a terminal that's part of an encrypted (P2PE) solution, a phone line, a payment page on your website?
Is the card reader connected to your POS, or a separate terminal?
Does any of your own equipment ever see the card number, or only the processor's?
Do you store card numbers anywhere? (The best answer is no.)

Two rules from the FAQ matter most. "All the eligibility criteria for a particular SAQ must be met to use that SAQ." And: "Merchants should consult with their compliance-accepting entity - the entity to which the SAQ will be submitted (typically, an acquirer (merchant bank) or a payment brand) to determine if they are eligible or required to submit an SAQ, and if so, which SAQ is appropriate for their environment."

In other words: don't pick an SAQ yourself from a blog post, including this one. Describe how you take cards to your acquirer, and ask which questionnaire they want, if any. The Council publishes a guide, PCI DSS Self-Assessment Questionnaire Instructions and Guidelines, in its Document Library.

One more thing the Council notes about encrypted terminals: "Payment terminals that are part of a PCI-listed P2PE solution provide merchants the best assurance about the quality of the encryption" (PCI SSC: Common Payment Systems). Ask your POS vendor whether its readers are part of one.

The everyday habits

Whatever your SAQ, the Council's Guide to Safe Payments for small merchants comes down to a few habits a café can actually keep (PCI SSC: Guide to Safe Payments).

Don't keep card numbers

The guide's headline: "IF YOU DON'T NEED CARD DATA, DON'T STORE IT." The FTC says the same to every business: "Don't keep customer credit card information unless you have a business need for it" (FTC: Protecting Personal Information).

Where card numbers sneak into a café:

Catering and phone orders written on a ticket or a notepad "to run later". Use your POS's invoice or payment link instead, so the customer pays without anyone writing anything down.
Emails and texts from customers who send their card number. The guide says: "If you receive card details via email, you can still process the transaction, but delete the email immediately and then let the sender know how you prefer to receive cardholder data (and that email is not the best way to send it)."
Old paper. If you must keep paper with card data, the guide says to "mark through the data with a thick, black marker until it is unreadable and secure the paper in a locked drawer or safe that only a few people have access to."

Check the card readers

Skimmers are small devices criminals attach to card readers. The guide's advice:

"KEEP A LIST of all payment terminals and take pictures (front, back, cords, and connections) so you know what they are supposed to look like."
"LOOK FOR OBVIOUS SIGNS of tampering, such as broken seals over access cover plates or screws, odd/different cabling, or new devices or features you don't recognize."
"PROTECT TERMINALS. Keep them out of customers' reach when not in use and restrict public viewing of the screens."
"If there is any suspicion that a terminal has been tampered with, DO NOT USE it, and report this immediately to your merchant bank and/or terminal vendor."

Lock down passwords and remote access

The guide tells merchants to "Ask your vendors or service providers about default passwords and how to change them. Then do it!" And the Council's merchant page warns: "Criminals can gain access to your systems that store, process, or transmit payment data through weak remote access controls. Remote access may be used by your payment terminal vendors, for example, to provide support to your terminal or to provide a software update." Ask your POS vendor how remote support works and how it's protected.

Keep the network separate

Card readers and the POS belong on the business network, never the guest Wi-Fi. Our network post covers the setup.

Train the team

A new barista won't know any of this unless you tell them. Add three rules to your new employee orientation: never write down a card number, never take one by text or email, and tell a manager if a card reader looks different.

A card-security checklist for a small café

Acquirer identified, and asked what (if anything) they need from you to validate
A list and photos of every card reader
Card readers checked for tampering on a schedule
No card numbers on paper, in email or in texts, and a payment link for phone orders
Card readers out of customers' reach when not in use
Default passwords changed on the POS, router and anything else on the business network
Remote access by vendors limited and protected
POS and card readers on the business network only
Every new hire taught the three rules
Cyber coverage discussed with your agent (see insurance basics)

Where Mays fits

Mays doesn't process card payments, and it doesn't ask for or hold card numbers. With Square connected, the payment sync brings in the amount, the tip, the status and the order it belongs to. For a chargeback, the Disputes board shows the card brand and the last four digits, as Square reports them. What Mays can do is make the habits stick:

A weekly card-reader check. Build a checklist template with a Photo task for each reader ("front and back of the counter reader") and a Checkbox for "no new cables, seals intact". Schedule it weekly and the photos become your record. See Creating a checklist template and Task response types.
The rules where staff look them up. Put your card-handling rules in the Knowledge Base, so every new hire can find them on their phone. See Knowledge Base basics.

Ask your acquirer one question this week

"What do you need from me to validate PCI compliance, and which SAQ, if any?" Write down the answer, keep the reader photos, and make the weekly check part of the routine.

Start your free trial: 30 days, every module, no card needed. Want to set up a weekly card-reader check? Book a walkthrough.