A shared responsibility for secure payments
If your business accepts card payments, you need to follow PCI compliance rules. These rules are set by the PCI Council and known as Payment Card Industry Data Security Standard (PCI DSS) to keep customer payment details safe from cyber threats and fraud. For Nochex as a payment facilitator, compliance is critical to maintaining trust and security across our payment ecosystem, it’s also about guiding our merchants to maintain safe payment practices.
Securing payment data requires collaboration between facilitators or payment providers and merchants. Here’s how the responsibility is shared:
| Integration Method | Description | PCI Compliance Responsibility | Applicable SAQ Type |
| Hosted Payment Page (Nochex Payment Page) | Customer is redirected to a secure, third party page to complete the transaction | Minimal Responsibility – Cardholder data is never handled or stored by the merchant. The payment provider assumes full responsibility for PCI Compliance | SAQ A |
| Embedded IFrame or JavaScript Library (Nochex API Widget)
payment fields hosted by provider, integrated via merchant’s website |
Payment fields are embedded on the merchant’s website but securely hosted by the provider. Merchants site does not affect the security of the payment form. | Low – Merchant does not handle card data but has minimal PCI scope, but must ensure no interference with the hosted elements | SAQ A |
| Hosted Virtual Terminal (MOTO) | Merchant manually enters cardholder data on behalf of customers using a secure web interface. | High – Merchant is directly handling card data and must secure the environment (e.g. devices, network, staff training) | SAQ C-VT |
While facilitators provide secure payment infrastructure, merchants must take steps to protect customer data:
If merchants fail to meet PCI DSS requirements, it can impact both merchants and payment facilitator
Merchants can seek guidance from: