PCI DSS scope
Reduce your PCI DSS scope
Cards from guests and partners come to PCI Booking, not to your OTA, PMS or channel manager, so your systems stay out of PCI scope. That drastically reduces your PCI DSS scope and simplifies your annual audit.
PCI DSS Level 1 service provider · ISO 27001:2022
Not sure PCI DSS applies to you? Two questions tell you.
For OTAs and booking engines, PMS and hotel tech and channel managers
What to expect
What changes, and what does not
Most platforms come to us with one sentence: we do not want raw card data in our own systems. Here is what moving it to PCI Booking does for your assessment, and what it does not.
| Part of your platform | Without PCI Booking | With PCI Booking |
|---|---|---|
| Website | In PCI scope | A remaining touchpoint: it embeds our hosted card form |
| Order system | In PCI scope | Holds tokens only |
| Database | In PCI scope | Holds tokens only |
| Staff email | In PCI scope | Holds tokens only |
| Partner connection | In PCI scope | Holds tokens only |
Every system that stores, processes or sends card data is assessed. With PCI Booking, your annual assessment covers less.
What stays in scope
Out of scope: your servers, databases, booking system and network. They hold tokens, not card numbers.
In a very limited scope:
- Web pages that embed our hosted card form.
- Staff who view cards through a display link, with their browsers and devices.
- Any phone or email channel where staff hear or type a card number before it reaches us.
What changes when cards live with us
- Your systems hold tokens, not card numbers.
- Fewer of your systems store, process or transmit card data.
- Your annual assessment covers less.
Cards reach PCI Booking directly from the hosted form, a card link or your partners. Your systems receive a token in their place.
What does not change
- Service providers handling more than 300,000 transactions a year still have an annual assessment.
- Level 1 merchants still have an annual assessment.
- SAQ A applies only when card capture is fully hosted and you are below Level 1.
- The requirements that stay with you are set out in our Shared Responsibility Matrix.
We will tell you what stays in scope for your setup.
Partner demands
When partners ask for proof
Partners like Booking.com ask for proof of PCI compliance before they send cards.
When cards reach you through PCI Booking, send those partners our Attestation of Compliance. They accept it on its own.
Evidence on request
Documents for your assessor
Our PCI DSS certificate is public. The documents below we send to you or your Qualified Security Assessor when you ask.
Attestation of Compliance
Our current PCI DSS Attestation of Compliance as a Level 1 service provider.
Shared Responsibility Matrix
Which PCI DSS requirements PCI Booking covers and which stay with you.
SAQ D whitepaper
A whitepaper written by a Qualified Security Assessor on SAQ D for businesses that use PCI Booking.
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.