> For the complete documentation index, see [llms.txt](https://docs.doku.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.doku.com/security/licenses/pci-dss-compliance.md).

# PCI DSS Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is a mandatory security benchmark designed to protect cardholder data wherever it is processed, stored, or transmitted. Compliance is required for every merchant accepting card payments, regardless of transaction volume, geographic location, or technical integration architecture.

As a certified [PCI DSS Service Provider](/security/licenses.md#pci-dss), DOKU undergoes rigorous annual audits to maintain high-level security standards, minimizing exposure to data breaches and financial fraud.

{% hint style="info" %}
Integrating via [DOKU Checkout](/accept-payments/integration-tools/doku-checkout.md) or [DOKU-Hosted Page](https://developers.doku.com/accept-payments/direct-api/non-snap/card/payment-page-integration-guide) keeps raw card data off your servers completely. This offloads the vast majority of PCI controls to DOKU's infrastructure, qualifying your business for the simplest compliance validation scope (SAQ A).
{% endhint %}

## Third-Party Service Provider (TPSP) Compliance Checklist

If your organization relies on external vendors that handle cardholder data, manage in-scope infrastructure, or impact your payment security, complete the following governance steps:

* Identify & Inventory TPSPs: Maintain a complete, up-to-date registry of all third-party vendors accessing your Cardholder Data Environment (CDE) or managing in-scope systems.
* Conduct Pre-Engagement Due Diligence: Perform technical risk evaluations and security reviews before onboarding any payment service vendor.
* Execute Formally Signed Agreements: Ensure written contracts explicitly state that the vendor acknowledges responsibility for the security of cardholder data in their possession.
* Collect Annual Validation Proof: Obtain an updated Attestation of Compliance (AOC) or Report on Compliance (ROC) from each third-party vendor annually.
* Acknowledge Ultimate Accountability: Maintain internal oversight of all payment workflows—outsourcing technical processing does not transfer your ultimate PCI DSS compliance liability.

{% hint style="info" %}
PCI DSS requirements evolve over time. Ensure your security team remains aligned with current compliance frameworks by visiting the [PCI Security Standards Council](https://www.pcisecuritystandards.org/).
{% endhint %}

## Step-by-step guide to PCI DSS Compliance

### Step 1: Assess Your PCI Compliance Level

PCI DSS compliance requirements depend on your 12-month transaction volume and breach history. Merchants fall into four distinct validation tiers:

| **Compliance Level** | **Annual Transaction Threshold**                                                                                                                                                  | **Validation Requirements**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Level 1              | <p>• > 6 million Visa / Mastercard transactions<br><br>• > 2.5 million American Express transactions<br><br>• Experienced a data breach, or designated Level 1 by card brands</p> | <p>• Annual Report on Compliance (<a href="https://www.pcisecuritystandards.org/document_library/">R</a><a href="https://www.pcisecuritystandards.org/document_library/">OC</a>) or Attestation of Compliance (<a href="https://www.pcisecuritystandards.org/document_library">AOC</a>) audited by an independent<a href="https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors"> Qualified Security Assessor (QSA)</a><br><br>• Quarterly network scans by an Approved Scanning Vendor (<a href="https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors">ASV</a>)</p>                                     |
| Level 2              | 1 million to 6 million total transactions                                                                                                                                         | <p>• Self-Assessment Questionnaire (<a href="https://www.pcisecuritystandards.org/document_library/?category=saqs#results">SAQ</a>), <a href="https://www.pcisecuritystandards.org/document_library">AOC,</a> or ROC<br><br>• SAQ A, SAQ A-EP, and SAQ D require <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors">QSA</a> or Certified Internal Security Assessor (<a href="https://www.pcisecuritystandards.org/assessors_and_solutions/become_isa/">ISA</a>) sign-off<br><br>• Quarterly network scans by an <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors">ASV</a></p> |
| Level 3              | 20,000 to 1 million e-commerce transactions                                                                                                                                       | <p>• Applicable Self-Assessment Questionnaire (<a href="https://www.pcisecuritystandards.org/document_library/?category=saqs#results">SAQ</a>) based on integration type<br><br>• Quarterly network scans by an <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors">ASV</a></p>                                                                                                                                                                                                                                                                                                                                                   |
| Level 4              | < 20,000 e-commerce transactions (or up to 1 million total transactions)                                                                                                          | <p>• Applicable Self-Assessment Questionnaire (<a href="https://www.pcisecuritystandards.org/document_library/?category=saqs#results">SAQ</a>) based on integration type<br><br>• Quarterly network scans by an <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors">ASV</a></p>                                                                                                                                                                                                                                                                                                                                                   |

### Step 2: Know Your Integration Type

Your chosen DOKU integration method directly determines your technical PCI DSS scope and which Self-Assessment Questionnaire (SAQ) applies:

| **Integration Method** | **PCI Scope** | **Required Document**                                                                                               | **Technical Description**                                                                                                                                                                                                                                                                                                              |
| ---------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DOKU Checkout          | Lowest Scope  | Not Required                                                                                                        | Payment forms are rendered entirely on DOKU servers. Primary Account Numbers (PAN) and CVVs never touch your backend infrastructure.                                                                                                                                                                                                   |
| DOKU Hosted Page       | Lowest Scope  | Not Required                                                                                                        | Complete payment redirection to DOKU's secure hosted domain.                                                                                                                                                                                                                                                                           |
| DOKU JS                | Partial Scope | SAQ A-EP Signed by [QSA](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors) | You host the payment HTML form and load DOKU's JavaScript SDK. While card payloads go directly to DOKU, your origin server remains in-scope due to web page tampering and script injection risks (e.g., Magecart). Requires [QSA](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors) sign-off. |
| Host-to-Host (API)     | Full Scope    | AOC                                                                                                                 | Unencrypted cardholder data passes through or stores on your server network, requiring comprehensive PCI DSS infrastructure controls and full auditing.                                                                                                                                                                                |

{% hint style="info" %}
To confirm your exact scope or engage a local Qualified Security Assessor (QSA) in Indonesia, consult certified auditing partners such as [TÜV Rheinland Indonesia](#third-party-service-provider-tpsp-compliance-checklist) or [Xynexis International](https://xynexis.com/), or search the official [PCI Security Standards Council Directory](https://www.pcisecuritystandards.org/).
{% endhint %}

### Step 3: Submit Compliance Documentation

After determining your required assessment type, complete the appropriate SAQ or AOC documentation and submit it to DOKU for review through your Account Manager or Integration Support team:

* High-Volume Merchants (Level 1 & 2): Engage a certified Qualified Security Assessor (QSA) registered in your operating region to audit your systems, guide remediation for security gaps, and sign the official compliance documentation (ROC/AOC).
* Standard Merchants (Level 3 & 4): Complete the Self-Assessment Questionnaire (SAQ) aligned with your specific integration type (e.g., SAQ A for DOKU Checkout). You can complete or upload your document directly using the PCI Dashboard in your DOKU Dashboard.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.doku.com/security/licenses/pci-dss-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.