The official PCI SAQ questions word for word, with plain-English guidance and photo evidence captured as you go — free on iPhone, iPad, Mac and Android.
Every business that takes card payments has to work through a PCI DSS Self-Assessment Questionnaire once a year. The questions are set by the PCI Security Standards Council and they have to be answered as written. What nobody had fixed is where you’re expected to answer them — at a desk, on a laptop, while the things the questionnaire is asking about sit in another room.
The questions are the questions — reword them and you haven’t filled one in. We put the questionnaire on the phone, let the camera do the filing, and kept the photos on the device where they belong.”
— Curtis Nash, CEO, Paytia
Paytia Comply moves the questionnaire to the phone in your pocket. All nine SAQ types, 966 real PCI DSS v4.0.1 requirements, one at a time, answered where the evidence actually is.
Pick the questionnaire that matches how you take payments — A, A-EP, B, B-IP, C, C-VT, D for Merchants, D for Service Providers or P2PE — or tap “Help me choose” and answer a few questions about your setup. Each SAQ shows what it covers and how many requirements it carries, from 28 for SAQ B up to 145 for A-EP. Then work through them, marking each Yes, No or N/A, with progress tracked as you go.
Read More on Fintech : Global Fintech Interview with Rob Young, Managing Director – UK at InDebted
THE QUESTION STAYS THE QUESTION
Open any requirement and the official PCI SSC wording is there under a heading that says, plainly, “The question”. It isn’t paraphrased or trimmed. A reworded SAQ isn’t an SAQ, and Paytia hasn’t touched them.
What Comply adds is everything around it: what the requirement actually means, and what evidence you’ll need to satisfy it — the documentation to examine, the personnel to interview, the configuration settings to check. The standard’s language stays intact. The explanation sits next to it.
THE CAMERA DOES THE FILING
Plenty of requirements want proof rather than a tick — the server room lock, the terminal setup, the visitor log. Collecting that has always been a chore of its own: photograph it, email it to yourself, download it on a laptop, rename it, then work out which requirement number it belonged to.
Comply cuts that out. You’re standing in front of the thing the question is about, so you tap Take photo and it attaches to that requirement. The photos stay on your device — this is evidence about how a business protects card data, and it isn’t the kind of thing that should be scattered across inboxes. When you’re finished, everything goes into a clean PDF you export or email yourself, for your acquirer or your QSA.
A POCKET REFERENCE FOR THE BROWSER, TOO
Not every PCI question comes up while you’re standing in a server room. Plenty arrive at a desk — usually as “which SAQ even applies to us?” or an acronym in an acquirer’s email. For those, Paytia also publishes a free Chrome extension, PCI SAQ Pocket Reference (chromewebstore.google.com/detail/pci-saq-pocket-reference/amkphflaeaegcigdnjdffclpmamjifcf).
It lives in the browser toolbar and does three things: an eight-question decision guide that lands you on the right SAQ, a plain-English glossary of fifteen PCI terms — PAN, CDE, AOC, P2PE and the rest — and links through to Paytia’s free checklists for SAQ A, A-EP, B and D. It works offline, asks for no permissions, carries no tracking, and the source is open under an MIT licence.
The extension answers the questions that come up at a desk; the app is where you complete the questionnaire itself — standing in front of the evidence. There’s also a free instant checker at paytia.com/resources/tools/which-saq — eight questions, answered in the browser, nothing collected.
WHY PAYTIA BUILT IT
Paytia has been a PCI DSS Level 1 certified provider since 2016, keeping contact centres and customer-not-present merchants compliant. The same thing kept happening. A business knows the annual SAQ is due, downloads the official PDFs, opens them on a laptop, and stops — because the document is written for the assessor who’ll eventually read it, and because half of what it asks about is somewhere else in the building.
The questions weren’t the thing Paytia could fix. Where you answer them was.
WHAT IT DOESN’T DO
Comply is a checklist and an evidence-capture tool. It isn’t legal or compliance advice, and your acquirer has the final say. It won’t certify anyone as PCI compliant — that takes an attestation from a QSA, or for SAQ-eligible merchants a self-attestation the business signs off. It doesn’t run external scans or penetration tests, and it doesn’t implement any of the technical controls the requirements call for. What it does is take the questionnaire off the laptop and put it where the evidence is.
“An SAQ isn’t something you’re allowed to simplify. The questions are the questions — reword them and you haven’t filled one in. What nobody had asked is where you’re supposed to be standing when you answer them. It’s never at a desk. It’s in the room with the card terminal, or the cabinet, or the visitor log. So we put the questionnaire on the phone, let the camera do the filing, and kept the photos on the device where they belong.” — Curtis Nash, CEO, Paytia
Catch more Fintech Insights : The AI Shift in Fraud: Why Banks Need a New Playbook
[To share your insights with us, please write to psen@itechseries.com ]
