SAQ C-VT
PCIComplianceHubLast updated
The Self-Assessment Questionnaire for merchants that key transactions one at a time into a web-based virtual terminal supplied by a PCI DSS compliant third party, using a device isolated from other systems and storing no account data electronically. Batch processing, or connecting the terminal into a wider network, breaks eligibility.
Applies to. Merchants that key one transaction at a time into a compliant third party's web-based virtual payment terminal, from an isolated computing device with a securely connected browser. Card-present or mail and telephone order, not e-commerce.
Limits. Isolation is the whole condition: the device must be in a single location and connected to no other location or system, which a firewall or segmentation can achieve. A connection to a cash register system, or a terminal that relies on another device to reach the provider, breaks eligibility, as does any electronic storage of account data.