For adult paysites and clip stores that take cards

Filed SAQ A, but your page loads the payment script? That is A-EP.

Strongbox asks how a store takes cards — who serves the payment form, whether card numbers pass through or are kept — points to the PCI questionnaire that fits, flags a mismatch with the one filed, and keeps the calendar: the attestation and the next one a year on, the acquirer’s deadline, and every quarterly scan with its result.

Open the demo See pricing

Opens in this browser with an invented clip store already in it. No account, no email address, nothing installed.

Strongbox with its example records in it

Open the free demo →

The problem

Adult merchants are watched closely.

Every merchant taking cards proves PCI DSS compliance the way its acquirer says — for most small merchants, a yearly Self-Assessment Questionnaire and Attestation of Compliance, plus quarterly scans if the questionnaire calls for them. Which questionnaire depends on how cards are taken. A hosted page is SAQ A; a page that loads the payment script is SAQ A-EP, with scans.

SAQ

Self-Assessment Questionnaires are the validation tool for eligible merchants to report their PCI DSS results.

PCI Security Standards Council →

Quarterly

scans by an Approved Scanning Vendor, when the questionnaire calls for them.

6 million

card sales a year, and a merchant is Level 1 — not a self-assessment.

Will not let the wrong questionnaire or a lapsed scan pass.

A questionnaire filed that does not fit how cards are taken is flagged — the acquirer’s word being final. A lapsed or failed scan, an attestation running out, and a deadline not met are each on the file. A scan dated in the future is refused. Scans follow the stricter of what is filed and what the answers point to.

How it works

How you take cards, the calendar, the file

Answer how cards are taken

Website, phone or terminal; who serves the payment form; whether card numbers are kept. Strongbox points to the questionnaire.

Keep the calendar

The attestation date and the next one, the acquirer’s deadline, card sales a year, and every scan.

Print the file

Every finding, the set-up and every scan, for the acquirer.

What it will never do

It keeps the calendar. It files nothing.

Strongbox points to the questionnaire. Your acquirer decides which one you file.

No card data.Strongbox never sees a card number.

No filing.You send the attestation; Strongbox records the day.

It is not a QSA.Not legal or compliance advice.

It never touches a payment.The subscription is for software.

Pricing

Priced per store

Less than a month of non-compliance fees.

Most stores

One store

$19/month

One paysite or clip store.

The questionnaire that fits
Yearly attestation dates
Every quarterly scan

One store, yearly

$190/year

The same, two months free.

Everything in One store
Mismatch flagged
Printable file for the acquirer

Subscription. Your bank statement says Strongbox Software. Refunded in full on request within 30 days. Your licence key is emailed to you within two working days of payment.

Checkout is our own bitcoin server, not a card processor — nobody we had to apply to and nobody who can close the account. The button takes you straight to it. Give your email address there — that is where your key is sent.

Questions

The ones we actually get asked

What is the difference between SAQ A and A-EP?

A fully hosted payment page is SAQ A. A page of your own that loads the payment form or its script is SAQ A-EP, with quarterly scans.

We store card numbers.

Then the answers point to SAQ D. Strongbox shows it the moment the answer changes.

Who decides?

Your acquirer. Strongbox flags a mismatch; their word is final.

Is this compliance advice?

No. It is the calendar you wish you had kept.

What do I actually get when I pay?

The demo on this page is the whole program, running on invented records. Paying gets you a licence key — one line of text, emailed to the address you give at checkout within two working days. Paste it into the program and from then on it keeps your own records. Until then, nothing you type into it is kept.

The key is checked inside the page, on your own machine. It never calls us, so there is still no account and nothing about your business goes anywhere. If you ever stop paying, your records stay exactly where they are, read-only, and Export still hands you every one of them.

Open the demo before the attestation runs out

The invented clip store files SAQ A while its page loads the payment script, its scans have lapsed with one failed, and its attestation is running out. Strongbox puts every one on the file.

Open the demo See pricing