u/FatBook-Air

SAQ A vs SAQ A-EP for this website?

I know that we otherwise qualify for SAQ A, but I am stuck on one requirement due to the way our website is setup. Here is that setup:

  1. ON OUR SITE: Users go to our website and choose what to purchase.
  2. ON OUR SITE: When it's time to pay, our website creates a URL string that contains some transaction data, like: transactionID=34, transactionAmt=395.03,userID=123
  3. ONE OUR SITE: Our website redirects the user is using a GET (not a POST) to our payment processor's website (ACI Speedpay) using that URL query string (e.g., https://www.acispeedpay.com/transactionpay?transactionID=34&transactionAmt=395.03&userID=123).
  4. ON PROCESSOR'S WEBSITE: The payment processor's website then displays the amount that is to be paid and what is being purchased, and once the user confirms that everything is correct, the user is then prompted for cardholder data to make a payment.

No cardholder data is collected, stored, or transmitted on any of our infrastructure. The only thing we are automatically sending to the payment processor is data about the purchase being made, because otherwise the user would need to be trusted to tell the payment processor they need to pay X number of dollars and cents.

Would this environment qualify for SAQ A?

reddit.com
u/FatBook-Air — 4 days ago