Authorize.net vs Stripe: the way you connect decides your SAQ

The PCI table

Each row is a question a shop owner asks of a gateway, with the requirement or form it maps to. “Ask the vendor” means the vendor's own pages did not say so when we read them on 2026-10-22; it does not mean no.

The SAQ A rows tie. The gap is around them: Stripe helps with the form itself and keeps its AoC in your Dashboard, while Authorize.net sends anyone, customer or not, to Visa's registry for its own. For the wider field of gateways judged the same way, see PCI compliant payment gateways.

Authorize.net and Stripe, one by one

Gateway only or all-in-one

Authorize.net's own FAQ draws the line: “A payment gateway is the technology that securely transmits payment data between a customer, your website or terminal, and the payment networks. A merchant account is the bank account that holds your funds after a transaction is approved.” Then: “Authorize.net's All-in-one plan includes both. If you already have a merchant account with a bank or payment provider, the Gateway Only plan connects Authorize.net to it without replacing your existing account.”

• Authorize.net, Gateway Only

  GatewayAuthorize.net

  Merchant accountYour bank or provider

  Your SAQ goes toThat merchant bank

  Any non-compliance feeFrom that acquirer

  You deal withGateway + your bank

• Authorize.net, All-in-one

  GatewayAuthorize.net

  Merchant accountThrough Authorize.net

  Your SAQ goes toAsk Authorize.net

  Any non-compliance feeAsk Authorize.net

  You deal withAuthorize.net

• Stripe

  Gateway and processingStripe

  Account you openOne Stripe account

  Your SAQ goes toStripe PCI Dashboard

  Any non-compliance feeAsk Stripe

  You deal withStripe

That split decides who reads your questionnaire. Before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. On Gateway Only, that is your bank, not Authorize.net. A PCI non-compliance fee on a merchant statement also comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council; our guide to PCI compliance fees shows where it hides.

Your shop on each

Many shops take cards more than one way. Describe your shop once and read what each gateway's setup points to, side by side. Stripe's guide says that with several methods “you must illustrate compliance for them separately,” so the last line lists every form in play.

Counter sales too? The SAQ type finder covers every channel, and the guide to every SAQ type explains each form.

Product for product

Developers moving from one gateway to the other ask the same thing: what is the Stripe equivalent of Accept Hosted? The table matches them by how the card number travels, which is what the SAQ follows.

The trap sits in the Accept.js row. The same library, loaded from “the Authorize.net servers,” gives SAQ A with Authorize.net's hosted form and SAQ A-EP with yours. Stripe's equivalent trap is Stripe.js v2 with your own form. PayPal has a twist of its own, set out in Stripe vs PayPal. A card number that reaches your server puts you on SAQ D, the full questionnaire.

Look up the AOC yourself

The Attestation of Compliance is “the official PCI SSC form for merchants and service providers to attest to the results of a PCI DSS assessment.” Your own SAQ needs the gateway's side of it. Requirement 12.8.4 reads: “A program is implemented to monitor TPSPs' PCI DSS compliance status at least once every 12 months.” Authorize.net's support article tells you where to look, step by step.

Stripe points to the same registry and to its Dashboard. Its PCI FAQ: “You can verify at Visa's registry and download the AoC from your dashboard.” A listing shows status; the AOC document itself comes from Stripe's Dashboard, or from Authorize.net through the registry route above. Our guide to the Attestation of Compliance covers your own.

Phone orders and the virtual terminal

Both gateways let staff type a card number from a phone call into a browser. The Council's SAQ C-VT is written for exactly that: “Merchants that manually enter payment account data a single transaction at a time via a keyboard into a PCI DSS validated and compliant third-party virtual payment terminal solution, with an isolated computing device and a securely connected web browser. No electronic account data storage.”

Stripe maps manual entry in its Dashboard to SAQ C-VT and limits it to “exceptional circumstances only, not routine payment processing.” Authorize.net offers its Virtual Terminal for phone orders (“Accept manual orders quickly and securely”), but the pages we read name no SAQ for it. For a shop that takes orders by phone every day, that difference matters more than any badge.

More choices for a phone desk are in PCI compliant virtual terminals and PCI compliant phone payments.

Questions