What PCI DSS means for small online stores

PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules created by the card networks. It applies to every business that accepts cards. For a small store, the good news is that smart choices keep your workload small.

The core idea

The less card data you touch, the less you have to protect. If customers type their card details into a page hosted and secured by a certified payment provider, those details never reach your servers. Your store sends the customer to the provider's secure form (or embeds it) and receives only the payment result.

Hosted checkout: the simple path

When you use a provider such as Razorpay with its hosted checkout, card and UPI details are entered on the provider's pages. Under PCI DSS, merchants whose payment pages are fully outsourced typically qualify for the simplest self-assessment questionnaire (often called SAQ A). Check the current criteria with your payment provider or acquirer, because the standard and its conditions evolve.

Never do this

• Store card numbers or the CVV, even "just for a while".
• Ask for card details over WhatsApp, email or phone to "process manually".
• Write card details in order notes or spreadsheets.
• Log payment forms in analytics or error tools.

Taking card data this way pulls you into far heavier obligations and creates a real risk.

What you still need to do

1. Use a compliant provider and keep a copy of their compliance evidence.
2. Secure your site: HTTPS everywhere, updated platform and plugins.
3. Lock down accounts: unique strong passwords, multi-factor authentication, and access only for people who need it.
4. Watch third-party scripts on checkout pages, because malicious scripts can steal data. Remove unneeded ones. Newer versions of the standard pay particular attention to scripts on payment pages.
5. Verify payment callbacks from your provider by checking their signature before you ship (security checklist).
6. Complete your annual self-assessment if your provider or bank requires it.

What your platform's role is

A good platform should use hosted payments, keep its own systems compliant and tell you plainly what it does and does not store. On Orvexa, card and UPI details are entered in Razorpay's checkout, and we store only a subscription reference. Read Razorpay for D2C for how gateways work.

UPI and card data are different

UPI payments have their own security framework run by NPCI and banks, while card data falls under PCI DSS. In both cases, using your provider's hosted flow means you do not handle the sensitive details.

Incidents

If you suspect card data was exposed, contact your payment provider immediately, change credentials and follow their instructions. Keep logs, because they may be needed.

What to do next

Check how your checkout collects payment: does the customer ever type card details on a page you control? If yes, ask your provider about switching to hosted fields or a redirect.