2 ms·
Most companies are never PCI audited because they're using a provider who already has been (like Stripe)
by bdcravens 2y ago
Most companies are never PCI audited because they're using a provider who already has been (like Stripe)
- jabart 2y agoAt volume you can no longer self-certify to be PCI SAQ-D. There are limits based on transaction count or volume.
- bdcravens 2y agoMakes sense. What are those volume limits like? I suspect the lion's share of companies like Stripe are those under those limits (since the largest companies are willing to trade simplicity for better rates) edit: according to a quick search, it looks like it's 6M transactions/year to require an audit vs self-assessment