PCI DSS Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is a mandatory security benchmark designed to protect cardholder data wherever it is processed, stored, or transmitted. Compliance is required for every merchant accepting card payments, regardless of transaction volume, geographic location, or technical integration architecture.

As a certified PCI DSS Service Provider, DOKU undergoes rigorous annual audits to maintain high-level security standards, minimizing exposure to data breaches and financial fraud.

Integrating via DOKU Checkout or DOKU-Hosted Page keeps raw card data off your servers completely. This offloads the vast majority of PCI controls to DOKU's infrastructure, qualifying your business for the simplest compliance validation scope (SAQ A).

Third-Party Service Provider (TPSP) Compliance Checklist

If your organization relies on external vendors that handle cardholder data, manage in-scope infrastructure, or impact your payment security, complete the following governance steps:

• Identify & Inventory TPSPs: Maintain a complete, up-to-date registry of all third-party vendors accessing your Cardholder Data Environment (CDE) or managing in-scope systems.
• Conduct Pre-Engagement Due Diligence: Perform technical risk evaluations and security reviews before onboarding any payment service vendor.
• Execute Formally Signed Agreements: Ensure written contracts explicitly state that the vendor acknowledges responsibility for the security of cardholder data in their possession.
• Collect Annual Validation Proof: Obtain an updated Attestation of Compliance (AOC) or Report on Compliance (ROC) from each third-party vendor annually.
• Acknowledge Ultimate Accountability: Maintain internal oversight of all payment workflows—outsourcing technical processing does not transfer your ultimate PCI DSS compliance liability.

PCI DSS requirements evolve over time. Ensure your security team remains aligned with current compliance frameworks by visiting the PCI Security Standards Council.

Step-by-step guide to PCI DSS Compliance

Step 1: Assess Your PCI Compliance Level

PCI DSS compliance requirements depend on your 12-month transaction volume and breach history. Merchants fall into four distinct validation tiers:

Compliance Level	Annual Transaction Threshold	Validation Requirements
Level 1	• > 6 million Visa / Mastercard transactions • > 2.5 million American Express transactions • Experienced a data breach, or designated Level 1 by card brands	• Annual Report on Compliance (ROC) or Attestation of Compliance (AOC) audited by an independent Qualified Security Assessor (QSA) • Quarterly network scans by an Approved Scanning Vendor (ASV)
Level 2	1 million to 6 million total transactions	• Self-Assessment Questionnaire (SAQ), AOC, or ROC • SAQ A, SAQ A-EP, and SAQ D require QSA or Certified Internal Security Assessor (ISA) sign-off • Quarterly network scans by an ASV
Level 3	20,000 to 1 million e-commerce transactions	• Applicable Self-Assessment Questionnaire (SAQ) based on integration type • Quarterly network scans by an ASV
Level 4	< 20,000 e-commerce transactions (or up to 1 million total transactions)	• Applicable Self-Assessment Questionnaire (SAQ) based on integration type • Quarterly network scans by an ASV

Step 2: Know Your Integration Type

Your chosen DOKU integration method directly determines your technical PCI DSS scope and which Self-Assessment Questionnaire (SAQ) applies:

Integration Method	PCI Scope	Required Document	Technical Description
DOKU Checkout	Lowest Scope	Not Required	Payment forms are rendered entirely on DOKU servers. Primary Account Numbers (PAN) and CVVs never touch your backend infrastructure.
DOKU Hosted Page	Lowest Scope	Not Required	Complete payment redirection to DOKU's secure hosted domain.
DOKU JS	Partial Scope	SAQ A-EP Signed by QSA	You host the payment HTML form and load DOKU's JavaScript SDK. While card payloads go directly to DOKU, your origin server remains in-scope due to web page tampering and script injection risks (e.g., Magecart). Requires QSA sign-off.
Host-to-Host (API)	Full Scope	AOC	Unencrypted cardholder data passes through or stores on your server network, requiring comprehensive PCI DSS infrastructure controls and full auditing.

To confirm your exact scope or engage a local Qualified Security Assessor (QSA) in Indonesia, consult certified auditing partners such as TÜV Rheinland Indonesia or Xynexis International, or search the official PCI Security Standards Council Directory.

Step 3: Submit Compliance Documentation

After determining your required assessment type, complete the appropriate SAQ or AOC documentation and submit it to DOKU for review through your Account Manager or Integration Support team:

• High-Volume Merchants (Level 1 & 2): Engage a certified Qualified Security Assessor (QSA) registered in your operating region to audit your systems, guide remediation for security gaps, and sign the official compliance documentation (ROC/AOC).
• Standard Merchants (Level 3 & 4): Complete the Self-Assessment Questionnaire (SAQ) aligned with your specific integration type (e.g., SAQ A for DOKU Checkout). You can complete or upload your document directly using the PCI Dashboard in your DOKU Dashboard.