PCI DSS SAQ-A
Definition
PCI DSS is the card industry's security standard for any business that handles card payments, and SAQ-A is its shortest self-assessment questionnaire. SAQ-A applies to merchants that fully outsource card entry and storage to a compliant payment provider, so no card number ever passes through the merchant's own systems. It is the lowest-effort way for an online store to stay compliant.
Why it matters for your store
Every merchant that accepts cards is subject to PCI DSS. The question is how much of it applies to you. If card numbers touch your servers, even in transit, you are responsible for network scans, penetration tests, logging rules, and a long questionnaire. If they never do, you answer a short form once a year and rely on your provider's certification.
The difference is decided by one design choice: where the card form lives. A form on your own page that posts card data to your server puts you in the expensive category. A form served by the provider, inside an iframe or on a redirect page, keeps you in SAQ-A. Many stores drift out of SAQ-A by accident when a plugin or theme adds a custom card form.
How Kambloo handles it
Kambloo keeps every store inside SAQ-A scope by design, and treats that as a product rule rather than a setting. All card gateways use the provider's own capture surface: iyzico Checkout Form, PayTR iFrame API, Stripe Payment Element, and the bank's 3D pages for direct virtual POS connections. Kambloo receives a token or transaction reference, never a card number, expiry, or CVV.
No module or theme can replace the payment area of the checkout. The theme system exposes that region as a locked slot. The database stores only the provider's references plus the card brand and last four digits for the order screen. Outgoing request logs mask card-related fields and authorization headers.
Saved cards work the same way: the provider holds the card and Kambloo holds a token, so one-click checkout does not widen your compliance scope.
Questions about PCI DSS SAQ-A
Do I need a PCI audit for my online store?
If your checkout uses the provider's hosted page or iframe and you never see card numbers, you fall under SAQ-A, which is a short yearly self-assessment rather than an on-site audit. Collecting card data in your own form expands the scope considerably.
Can Kambloo see my customers' card numbers?
No. Card fields are rendered by the payment provider inside an iframe or hosted page. Kambloo receives only a token or transaction reference, plus the card brand and last four digits for display.