PCI DSS compliance
PCI DSS SAQ
Annual PCI DSS Self-Assessment Questionnaires (SAQ A, A-EP or D) completed correctly and filed on time.
The SAQ is not a formality. It is a declaration about how your agency handles card data, and the wrong answers create liability. We make sure the questionnaire you file matches reality.
Who this is for
- Agencies that accept payment cards for BSP ticket sales and must evidence PCI DSS compliance to IATA each year.
- Agencies that have received a compliance reminder or non-compliance notice and are unsure which SAQ type applies.
- Agencies whose card handling has changed (a new website, a new payment link provider, a new GDS setup) and need to reassess their SAQ type.
What is included
- A scoping call to map exactly where card data enters and leaves your agency: phone, email, website, GDS, payment links.
- Determination of the applicable SAQ type (A, A-EP or D) based on that mapping, with a written explanation of why.
- Question-by-question completion of the SAQ with your team, in plain language.
- Preparation of the Attestation of Compliance and guidance on filing it with the right party.
- A short list of any practices that would fail the questionnaire, with practical fixes, and a renewal reminder for next year.
- Typical timeline
- One to two weeks from the scoping call, driven mostly by how quickly your team can answer questions about card handling. Renewals for existing clients are usually done in days.
- What your agency provides
- A description of every channel through which you accept cards, including any e-commerce or payment-link provider.
- Your previous SAQ and attestation, if one exists.
- Access to whoever actually takes card payments day to day, who is often not the manager.
Common questions
Is this your situation?
Send a short description by email or WhatsApp. The diagnostic call is free and tells you whether this is the right service.