PCI DSS
The PCI DSS questionnaire your agency files every year. Prepared on the official form.
We determine which SAQ applies to how your agency takes cards, complete the PCI Security Standards Council's questionnaire with your details and deliver it ready to sign, with a reminder before it expires.
In short
Travel agencies that accept payment cards on BSP sales must comply with PCI DSS and validate it every year, normally with a Self-Assessment Questionnaire (SAQ). The type depends on how cards are taken: SAQ A for payment links and for websites that redirect to or embed the provider's payment page, SAQ A-EP when the agency's website builds the payment form, SAQ C-VT for a virtual terminal, and SAQ D when card data is stored electronically.
SAQ types
Which SAQ fits your agency.
The questionnaire follows the way card data moves through your agency, not the size of the agency or its accreditation model.
| SAQ | Typical agency setup | ASV scans | What we do |
|---|---|---|---|
| SAQ A | Payment links sent to the customer; no card data entered on your systems | Not required | We prepare it |
| SAQ A | Website that redirects to, or embeds, the provider's payment page | Quarterly | We prepare it and run the scans |
| SAQ A-EP | Website that builds the payment form itself (direct post or JavaScript) | Quarterly | We review your setup and prepare it with you |
| SAQ C-VT | Card details keyed into a provider's virtual terminal, one at a time, nothing stored | Not required | We prepare it |
| SAQ D | Card numbers stored electronically: files, email, spreadsheets or GDS remarks | Quarterly | We tell you on the first call and help you find a QSA |
SAQ B, B-IP, C and P2PE apply to card terminals and payment software at a physical point of sale. If one of them fits your agency better, we tell you on the first call.
01 · Departures
Find your SAQ in one click.
Boarding passThe customer pays on the provider's page and card data never touches your systems: the shortest questionnaire, and no scans.
A guide, not a ruling: we confirm your SAQ type against the PCI SSC eligibility criteria before preparing anything.
What is included
Everything up to your signature.
- A mapping of every channel where card data enters your agency: phone, email, website, GDS and payment links.
- The SAQ type that applies, with a written explanation of the eligibility criteria that decided it.
- The official PCI SSC questionnaire completed with your agency's details, and its Attestation of Compliance.
- Quarterly ASV scans when your SAQ requires them, with follow-up on anything a scan finds.
- A short list of any practice that would fail a requirement, with a practical fix for each.
- A reminder sixty days before the SAQ expires, so next year's renewal starts on time.
What we need from you
- How you accept cards today, including any website or payment-link provider.
- Your agency's legal details and IATA code, and the name and title of the person who signs.
- Your previous SAQ and attestation, if there is one.
03 · Flight plan
Three legs. You fly only the last one.
- Leg 1 · Check-in
Answer a short questionnaire
How you take cards, your agency's details and who signs. Once, by email or in your free account.
- Leg 2 · In flight
We prepare everything
The right SAQ on the official PCI SSC form, plus ASV scans scheduled when your SAQ requires them.
- Leg 3 · Arrival
You review, sign and submit
A PDF ready to submit to IATA, and a reminder before next year's renewal.
02 · On autopilot
After take-off, we keep watch.
Quarterly ASV scans
When your SAQ requires external scans, an Approved Scanning Vendor recognised by the PCI SSC scans your website every quarter. We schedule each scan, follow up on findings and add every passing report to your file.
Renewals that never slip
We keep your answers and your dates. Sixty days before your SAQ expires, we contact you to renew it.
Official forms. Every time.
Your SAQ is the PCI Security Standards Council's own questionnaire, completed with your agency's details and ready to submit to IATA. Nothing rebuilt, nothing summarised.
Common questions
Do IATA travel agencies need PCI DSS?
Yes, if they accept payment cards for BSP sales. IATA asks accredited agents that take card payments to comply with PCI DSS and to validate that compliance every year, usually with a Self-Assessment Questionnaire (SAQ) and its Attestation of Compliance.
Which SAQ does a travel agency need?
It depends on how the agency takes cards. Payment links, or a website that redirects to or embeds the provider's payment page, usually mean SAQ A. A website that builds its own payment form means SAQ A-EP. Keying cards into a provider's virtual terminal means SAQ C-VT. Storing card numbers electronically means SAQ D. We confirm the type against the PCI SSC eligibility criteria before preparing it.
What is an ASV scan and when is it required?
An external vulnerability scan of your internet-facing systems, run by an Approved Scanning Vendor listed by the PCI Security Standards Council. It is required at least once every three months when your SAQ includes requirement 11.3.2: for example SAQ A for an agency whose website redirects to or embeds the payment page, and SAQ A-EP.
Do you submit the SAQ to IATA for us?
No. The SAQ is a declaration your agency makes, so an authorised person at the agency signs it and submits it. We deliver it completed and ready to sign, and tell you what to send.
How long does it take?
One to two weeks from the moment we have your answers, mostly driven by how quickly your team replies. Renewals for existing clients are usually done in days.
Do GoLite agencies need PCI DSS?
If the agency accepts payment cards for ticket sales, yes. The accreditation model changes how you settle with the BSP, not whether card-handling rules apply to you.
What happens if we do not file?
Non-compliance has consequences under IATA's card sales rules, up to losing the ability to accept cards for BSP sales, and it exposes the agency contractually to its acquirer.
How often does the SAQ have to be renewed?
Every year. PCI DSS compliance is validated annually, and again whenever the way you take cards changes, for example a new website or a new payment provider.
Is the SAQ in English?
Yes, we prepare the official English questionnaire published by the PCI SSC. We explain every question in your language and keep the answers in your file for next year.
Can you make us PCI compliant?
We make sure your questionnaire is the right one and answered truthfully, run the ASV scans it requires and tell you what must change where a practice fails a requirement. We do not do penetration testing or remediation engineering.
Final call
Ready for departure?
First time or renewal, your PCI DSS prepared by specialists in travel agency compliance.
