Platform guide
Square PCI compliance: what Square handles, and your part
Square PCI compliance is simpler than many setups, because Square's hardware and software handle card data on its systems. However, your own habits and accounts still matter, so it is not entirely hands-off.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What Square handles in Square PCI compliance
When cards are taken on Square's devices or its online checkout, card data is processed by Square rather than your systems. Therefore much of the technical burden sits with Square. Check Square's own documentation for its current position.
What you still own in Square PCI compliance
Your practices still matter. So review these habits.
- Never writing card numbers down for later entry
- Not taking card details by email or text
- Protecting your Square account with strong sign-in
- Controlling which staff can issue refunds
Square PCI compliance check
Tick each statement that is true.
Your result appears here as you tick, so you can see what is still open.
When Square PCI compliance gets more complex
Some choices move you outside the simple setup.
| Situation | Effect |
|---|---|
| Only Square devices and checkout | Simplest position. |
| Keying cards into the dashboard | Manual entry adds risk to manage. |
| Another processor alongside | Its rules also apply. |
| Storing card data elsewhere | Much larger scope. |
Common Square PCI compliance mistakes
Shared logins and paper notes with card numbers are the usual problems. Also, giving every staff member refund rights creates fraud risk. Each one is easy to fix once spotted.
Review staff permissions twice a year. It takes minutes, but it closes one of the most common gaps in small shops.
Where we help
We check side channels and account security, and confirm what your acquirer expects. However, we are not a QSA, and we are not affiliated with Square. The standard is in the PCI SSC document library.
Also keep a short note of how you confirmed Square's compliance each year. Your acquirer or a business customer may ask, and a dated record answers quickly. It also reminds you to review your own setup at the same time.
Square PCI compliance questions
Does Square PCI compliance cover our business entirely?
Square handles card processing on its systems, but your own practices still matter.
Do Square sellers complete a questionnaire?
It depends on Square's terms and your setup, so check Square's current guidance.
Does keying cards affect Square PCI compliance?
It adds risk, because card numbers pass through people and devices you control.
Are you affiliated with Square?
No. We are independent.
Related guides
Check your Square setup
Describe how you take payments. We reply in writing with any gaps.
Ask us anything