Is Square PCI compliant? What Square says, and what stays yours

The answer in Square's words

Square says yes, for itself. Its payment security page lists “PCI Data Security Standard, Level 1” among its credentials, and it makes a second, bigger claim about you. Read both sentences together, because the second one carries the condition:

Both are true at once. A TPSP is a third-party service provider, and Square is yours. Square's statement is about what you owe Square: no questionnaire, no fee, while every card stays inside its products. The standard's sentence is about what you owe the rule: anything you do with card data outside Square is still your job. Square's own article agrees on the principle: “Any merchant with a merchant ID that accepts payment cards must follow PCI-compliance regulations.”

What Square's compliance covers

Each line below is Square's own claim, quoted from its pages, with the edge of what it covers. None of it is our verdict on Square; it is where each claim stops.

The proof behind the first line is something you can ask for. Square's Trust Center shows a “PCI DSS AOC” (Attestation of Compliance) and a “PCI DSS Merchant Responsibility Matrix” among its documents, both behind a lock that asks you to request access. Those two papers answer Requirement 12.8.4 (check each provider's compliance status “at least once every 12 months”) and 12.8.5 (record which requirements the provider manages and which are yours).

The condition, checked against your shop

Square's promise hangs on three words: “storage, processing, and transmission.” If card data is stored, processed or sent anywhere other than Square, the condition no longer holds for you, and the reassurance with it. Small shops rarely break it on purpose. They break it with a habit: a pad by the phone, a customer who texts a card number, a second terminal kept for one kind of sale.

The list covers common ways card data slips outside a provider. It is not a questionnaire, and it does not tell you which SAQ you would file; for that, the SAQ type finder walks the Council's eligibility rules for your channels.

What a Square seller still owns

Even with every card inside Square, the standard keeps a short list on your desk. Requirement 12.8.1's note is the reason: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” Here is that list, with the Square-shaped way to meet each line.

• Req. 12.8.1

  “A list of all third-party service providers (TPSPs) with which account data is shared or that could affect the security of account data is maintained, including a description for each of the services provided.”

  With Square: Square goes on that list, with what it does for you: card readers, online payments, invoices, whatever you use.

• Req. 12.8.4

  “A program is implemented to monitor TPSPs’ PCI DSS compliance status at least once every 12 months.”

  With Square: Request Square’s PCI DSS AOC from its Trust Center once a year and file it with the date.

• Req. 12.8.5

  “Information is maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.”

  With Square: Square’s Trust Center lists a PCI DSS Merchant Responsibility Matrix. Request it and keep it with the AOC.

• Req. 3.3.1

  “SAD is not stored after authorization, even if encrypted.”

  With Square: Square’s own article agrees: entities “must never store sensitive authentication data after authorization.”

• Req. 9.4.6

  Paper with card data is “cross-cut shredded, incinerated, or pulped” when no longer needed.

  With Square: Any slip, form or note with a card number on it. Square never sees it, so Square cannot cover it.

• Square removesthe questionnaire, on its condition

Two of those lines are about cards that never reach Square at all, which is why they stay yours whatever any provider says. If you do keep card details for repeat customers, read how to store credit card information before you write another one down.

When you would validate

Square's statement is about validating “to Square.” Who else can ask you is set outside Square: the Council says “Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.” So the timing question comes down to which of these describes you today.

The last line on that receipt is the one dated duty every Square seller has: Requirement 12.8.4's yearly check of your provider's status. The scope review in Requirement 12.5.2 adds a second trigger, “at least once every 12 months and upon significant change,” which is why a new channel means a fresh look at the condition.

If a second provider or your bank does ask for a questionnaire, the Council's advice applies: before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. Our guide to PCI compliance fees explains what happens on a statement when that paperwork is late.

Readers, P2PE and the SAQ question

Square publishes no map from its products to the Council's questionnaires. Its PCI pages answer the SAQ question with the no-validation statement instead, so for any setup the honest answer is “ask the vendor.” What we can show is the Council's own description for each channel, which is what any SAQ you are ever asked to file will be judged against.

The reader line matters most for shops. A PCI-listed P2PE solution “can significantly help to reduce the PCI DSS validation effort of a merchant's cardholder data environment,” but only a solution on the Council's P2PE list qualifies a merchant for SAQ P2PE. Square was not on that list when we read it. Its Trust Center does list “PCI PTS POI”, “PCI PIN” and “PCI MPoC” among its compliance items; those are standards for devices, PINs and phone-based acceptance, not a P2PE listing.

Square beside other processors

Square's answer stands out among the processors compared on this site. It tells you there is nothing to file with it, on its condition; the others name a questionnaire, set a deadline, or offer a listed P2PE route. No approach changes Requirement 12.8.1. Here is what each of the others says in its own words, with the full side-by-side for each pair.

If you are choosing rather than checking, the questionnaire a provider puts you on is the PCI cost that lasts. Square trades a published SAQ map for a single condition; Stripe and PayPal name SAQs in their own docs; Clover and Stripe give counter shops a listed P2PE route.

Quick reference

Questions