PCI DSS compliance for startups, run for you

If your startup takes card payments, PCI DSS applies to you, whether you process ten transactions a month or ten million. The good news is that how you design payments decides most of the work. This page explains the current standard, how to figure out which questionnaire applies, what software can automate, and what stays with your team, your acquirer and your assessor.

What is PCI DSS?

PCI DSS is a contractual standard, not a law. Your acquiring bank and the card brands require it. It is organized into 12 core requirements.

1. Install and maintain network security controls.

2. Apply secure configurations to all system components.

3. Protect stored account data.

4. Protect cardholder data with strong cryptography during transmission over open, public networks.

5. Protect all systems and networks from malicious software.

6. Develop and maintain secure systems and software.

7. Restrict access to cardholder data by business need to know.

8. Identify users and authenticate access to system components.

9. Restrict physical access to cardholder data.

10. Log and monitor all access to system components and cardholder data.

11. Test security of systems and networks regularly.

12. Support information security with organizational policies and programs.

What changed with PCI DSS v4.0.1?

PCI DSS v4.0.1 was published in June 2024 as a limited revision with no added or deleted requirements. Version 4.0 was retired on 31 December 2024. The requirements v4.0 marked as future-dated, including 6.4.3 and 11.6.1 for payment page scripts and tamper detection, became mandatory on 31 March 2025.

Who needs PCI DSS?

• E-commerce startups that accept card payments online.

• SaaS platforms that embed payments for their own customers.

• Fintech companies that handle card data or card-funded flows.

• Service providers that store, process or transmit card data for others, or can affect its security.

• Marketplaces and subscription businesses taking recurring card payments.

What does PCI DSS take?

The biggest decision is scope. The fewer systems that touch card data, the shorter your questionnaire.

Which PCI SAQ applies to you?

• Controls: network security, secure configuration, MFA, logging and monitoring, vulnerability management, quarterly ASV scans, penetration testing where your validation type requires it.

• Documents: security policies, an inventory of system components in scope, data flow diagrams, targeted risk analyses and an incident response plan.

• Evidence: configuration records, access reviews, scan and pentest reports, training records and your Attestation of Compliance.

What NexusVoid automates vs what you still do

How NexusVoid gets you ready and keeps you ready

NexusVoid runs your security program like an autonomous CISO, and PCI DSS readiness is the by-product. If you have no CISO, it acts as one. If you have a CISO or vCISO, it automates most of their work. The loop is Detect, Prove, Resolve, Test, Verify.

• Argus finds and fixes: outside-in like an attacker with no credentials or installs to begin, then inward through code, dependencies, cloud and secrets. It catches exposed secrets and vulnerable dependencies near your payment flows, fixes them as pull requests, and retests on merge.

• Aegis proves: tailored policies, automatic evidence, a risk register, vendor management for your payment providers, employee security training, a device agent and auditor-ready exports.

• Striker tests: vulnerability assessment and pentest for web, API, cloud and mobile, pay per scan, with a report in under 60 minutes.

Common PCI DSS mistakes

• Storing card data you do not need, which pushes you toward SAQ D.

• Picking an SAQ without confirming eligibility with your acquirer.

• Ignoring the scripts that run on your payment page.

• Treating PCI as a once-a-year form instead of continuous controls.

• Forgetting that service providers and sub-processors in your payment flow need their own attestation.

• Assuming a general vulnerability scan replaces a quarterly ASV scan.

Frequently asked questions

What is the current version of PCI DSS?

PCI DSS v4.0.1, published in June 2024, is the only active version. It was a limited revision that added or removed no requirements. PCI DSS v4.0 was retired on 31 December 2024, and the requirements that v4.0 marked as future-dated became mandatory on 31 March 2025, so assessments now include all of them.

Which PCI SAQ do I need?

It depends on how you accept cards. If a validated provider handles the entire payment page and your systems never store, process or transmit card data, you may qualify for SAQ A. If your site affects how card data is collected, SAQ A-EP may apply. If you store card data, or you are a service provider, you are generally looking at SAQ D. Your acquirer has the final say.

Do startups need a QSA for PCI DSS?

Not always. Card brands and acquirers set validation levels based on annual transaction volume. The highest-volume merchants generally need an annual Report on Compliance from a Qualified Security Assessor, while lower-volume merchants can usually complete a self-assessment questionnaire and Attestation of Compliance. Service providers are assessed under their own levels. Ask your acquirer which applies to you.

Can NexusVoid run our PCI ASV scans?

No. Requirement 11.3.2 calls for external vulnerability scans at least once every three months by a PCI SSC Approved Scanning Vendor, and NexusVoid is not one. Argus and Striker find and fix vulnerabilities continuously between those scans, so your quarterly ASV scans are more likely to pass, but the ASV scan itself must come from a listed vendor.

What is the easiest way for a startup to reduce PCI scope?

Keep card data off your systems. Using a validated payment provider’s hosted payment page or embedded fields means your servers never store, process or transmit card numbers, which can shrink your requirements dramatically. Do not store card data you do not need. Confirm the eligibility conditions of the current SAQ with your acquirer, because SAQ A was updated in 2025.

If you take card payments and want to know how small your PCI scope could be, book a call at /contact and we will look at your payment setup with you.