# PCI DSS compliance in days, not months

Orchestrapay takes card data out of your systems. Cards are captured and vaulted
in an isolated, PCI DSS compliant payment form, so your servers stay out of
scope. Merchants who outsource all card capture this way can usually
self-assess with SAQ A, the shortest questionnaire; your acquirer or QSA makes
the final call.

Page: https://www.orchestrapay.com/solutions/pci-dss-compliance

## What Orchestrapay carries for you

- **Isolated card form.** Cards are typed into a form served from its own
  domain and embedded in your checkout.
- **Scripts locked by hash.** The card form loads no third-party scripts and
  pins every script by hash (PCI DSS 6.4.3).
- **Tamper monitoring.** A separate monitor watches the payment page for
  changes (PCI DSS 11.6.1).
- **Encrypted vault.** Card numbers are stored with AES-256-GCM and versioned
  keys.
- **Masked from logs.** Card numbers, security codes and expiry dates are masked
  before anything is logged.
- **Security code never kept.** The CVV is used once to authorise, then dropped.

## Months vs days

Handling cards yourself: all 12 PCI DSS requirement areas, quarterly ASV scans,
annual penetration tests, key management for stored cards, and a QSA Report on
Compliance once your volume requires it.

With Orchestrapay: embed the hosted card form, card numbers never reach your
systems, your scope shrinks to how you embed the form, and most merchants can
self-assess with SAQ A.

## How it works

1. **Embed the card form** with the React SDK or the hosted page.
2. **Move stored cards** into your vault; Orchestrapay coordinates the import
   with your current processor.
3. **Self-assess** with the short questionnaire your acquirer asks for.

## FAQ

**Does using Orchestrapay make me PCI DSS compliant?** Every business that
accepts cards still validates compliance; Orchestrapay shrinks how much of PCI
DSS applies to you.

**Is Orchestrapay PCI DSS compliant?** Yes. Our card form, vault and payment
infrastructure are assessed against PCI DSS.

## Related

- [Card Vault](https://www.orchestrapay.com/products/card-vault.md)
- [Apple Pay & Google Pay](https://www.orchestrapay.com/products/apple-pay-google-pay.md)
- [3D Secure](https://www.orchestrapay.com/products/3d-secure.md)
- [Talk to sales](https://www.orchestrapay.com/contact)