Clover vs Toast: the PCI side of a restaurant POS
Published
For a restaurant owner choosing between Clover and Toast, the PCI question is narrow and it matters: is the card hardware part of a validated point-to-point encryption (P2PE) solution, and how much of the paperwork does that take off your plate? Both are on the PCI Security Standards Council's P2PE list. Neither one files your questionnaire for you, and neither listing covers online ordering. This page reads both listings, both providers' own statements and the Council's rules for which SAQ you file.
The two P2PE listings
Each provider has one entry on the Council's list of validated P2PE solutions (138 solutions on 2026-10-22). Here they are line for line. Toast's entry sits under Bluefin Payment Systems, the listed solution provider; Clover's sits under Clover Network itself.
Clover
Solution provider on the list: Clover Network Inc, a wholly-owned subsidiary of First Data Corporation
Listed solutionClover
StandardP2PE v3.1
Reference2024-00893.006
Annual revalidation7 May 2027
Reassessment7 May 2027
Assessed by CGI Technologies and Solutions, Inc.
StatusListed, 2026-10-22
Toast
Solution provider on the list: Bluefin Payment Systems
Listed solutionToast P2PE
StandardP2PE v3.2
Reference2026-00897.048
Annual revalidation21 Apr 2027
Reassessment21 Apr 2029
Assessed by Frazier & Deeter, LLC
StatusListed, 2026-10-22
What a listing does to your SAQ
“A PCI-listed point-to-point encryption solution includes a combination of secure devices, applications and processes that encrypt cardholder data from a PCI-approved point-of-interaction (POI) device through to a secure decryption environment.” Your network only ever carries scrambled data, which is the whole point (the P2PE guide and tokenization vs encryption go deeper).
In the Council's words, a listed solution “can significantly help to reduce the PCI DSS validation effort of a merchant's cardholder data environment.” In practice that means SAQ P2PE: “Merchants using only a validated, PCI-listed Point-to-Point Encryption (P2PE) solution. No access to clear-text account data and no electronic account data storage.” It is not for e-commerce. The word that trips restaurants up is only: one laptop that touches card numbers takes you out of it.
Clover and Toast side by side
Each row is a question the rule raises. “Ask the vendor” means their own pages did not say.
Swipe sideways for more vendors
| What a restaurant needs | Clover | Toast |
|---|---|---|
| Validated P2PE listing on PCI SSCSAQ P2PE | Yes | Yes |
| Says which of its devices sit in that listingSAQ P2PE | Ask the vendor | Ask the vendor |
| States its own Level 1 service provider statusReq. 12.8.4 | Ask the vendor | Yes |
| Online wizard to help with your SAQSAQ | Yes | Ask the vendor |
| Breach liability waiver on offerBreach cover | Yes | Ask the vendor |
| Says how offline card payments are protectedReq. 3.5.1 | Ask the vendor | Yes |
| Handheld for paying at the tableHardware | Yes | Yes |
| Online ordering covered by SAQ P2PESAQ-IG p. 21 | No | No |
| Makes your restaurant PCI compliant by itselfReq. 12.8.1 | No | No |
Check your restaurant's channels
SAQ P2PE is judged by every way you take cards, not by the terminal brand. Tick yours. Restaurants that take card numbers over the phone for catering should also read phone payments compared.
Tick every way your restaurant takes cards. Pre-filled with a typical full-service setup.
Inside / Outside / Ask2 / 1 / 1
SAQ P2PE alone does not cover this setup. Ask your acquirer how to validate the channels marked Outside.
Each provider up close
Clover
Clover Network's countertop and handheld POS on First Data processing, sold to restaurants, retail, service and healthcare businesses.
FitsA café, counter-service spot or shop with retail on the side
Validated P2PE listingYes
Level 1 service provider statementAsk the vendor
Not stated on their site when read on 2026-10-22.
Online SAQ wizardYes
Devices in the listing namedAsk the vendor
Not stated on their site when read on 2026-10-22.
The PCI help sits in Clover Security Plus, which Clover describes as “end-to-end encryption and tokenization technology,” a “PCI Rapid Comply Solution” (“a simple, online PCI compliance wizard”), a breach “liability waiver” and a Security Score. Clover Security Plus
Security Plus is a package Clover invites you to ask about, so confirm your account has it before you count on the wizard or the waiver.
VerdictMixed counters, SAQ help
Toast
A POS built only for restaurants and food and beverage retailers.
FitsA full-service or quick-service restaurant, or a multi-location group
Validated P2PE listingYes
Level 1 service provider statementYes
Online SAQ wizardAsk the vendor
Not stated on their site when read on 2026-10-22.
Devices in the listing namedAsk the vendor
Not stated on their site when read on 2026-10-22.
Toast's annual report says: “Toast is a PCI-DSS compliant Level 1 Service Provider. All of our card processing products and services are assessed annually by an independent security organization that has been qualified by the PCI Security Standards Council to validate an entity's adherence to PCI-DSS.” Toast Form 10-K
Its listing, “Toast P2PE,” is held by Bluefin Payment Systems as the solution provider, so ask Toast who sends you the P2PE Instruction Manual.
VerdictRestaurant-only operations
What stays your job
The Council is blunt about it: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” With either provider, these stay with you. The SAQ type finder confirms your questionnaire, and the attestation guide covers the form you sign.
Yours, with either provider
Carry out the PIM controlsSAQ P2PE
Every control in the P2PE Instruction Manual (PIM) your solution provider gives you.
Keep card data on the listed devices onlySAQ P2PE
No card numbers typed into a laptop, taken by email or saved in a reservation note.
Shred paper with card numbersReq. 9.4.6
Catering slips and deposit forms are “cross-cut shredded, incinerated, or pulped” when no longer needed.
List your service providersReq. 12.8.1
Your POS provider, your online ordering service and anyone else that touches or could affect card data.
Validate online ordering on its ownSAQ-IG p. 21
SAQ P2PE does not reach e-commerce, so that channel needs its own answer.
Confirm your SAQ with your acquirerSAQ-IG p. 2
Check eligibility with the organization you submit it to, usually your acquirer, not the POS provider.
Handed to Clover or ToastNone
Questions owners ask
If my Clover or Toast terminals are P2PE listed, do I still file anything?
Yes. A listed solution can qualify you for SAQ P2PE, but you still complete that questionnaire and sign the attestation that goes with it. One of its eligibility criteria is that you have implemented every control in the P2PE Instruction Manual (PIM) your solution provider gives you.
Before you start, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it.
Does Visa let a P2PE restaurant skip validation?
Sometimes. Visa's Technology Innovation Program can remove the requirement to verify PCI DSS compliance “when at least 75% of yearly transactions originate through EMV chip-enabled terminals, a validated point-to-point encryption solution or integrated industry-standard tokenization solution meeting EMVCo Tokenization Specification.” Eligibility is Visa's and the acquirer's call, so ask before you stop filing.
What happens if a listing lapses?
A P2PE solution on the Council's expired list no longer counts as “validated,” and the Council tells merchants on an expired solution to check with their acquirer or the card brands before using SAQ P2PE. Each listing above shows its annual revalidation date; check the Council's list again near it.
Our online ordering runs through the POS provider. Does SAQ P2PE cover it?
No. The Council says of SAQ P2PE: “This SAQ is not applicable to e-commerce channels.” Online ordering is validated as its own channel. If guests pay on a page the provider hosts, start with the SAQ A criteria. Validation requirements are set by the card brands and acquirers, so your acquirer decides how the two channels are reported.
What about card payments taken while the internet is down?
Toast's annual report says that “In offline mode, credit card information is securely encrypted and stored on the Toast device until it regains connection.” Clover's pages we read did not cover offline payments. Ask either provider whether offline transactions stay inside its listed P2PE solution.
Is an encrypted card reader the same as P2PE?
Not for your paperwork. Only a solution on the Council's list qualifies a merchant for SAQ P2PE; an “encrypted reader” that is not listed does not. That gap is the PCI story of Square vs Clover.
Sources
- PCI SSC: Validated P2PE Solutions list (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: SAQ Instructions and Guidelines v4.0.1 r1 (April 2025) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: At a Glance, P2PE v3 (July 2020) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- Visa: Security and compliance (corporate.visa.com), read on 2026-10-22
- Clover: Clover Security Plus (clover.com), read on 2026-10-22
- Clover: Restaurant POS (clover.com), read on 2026-10-22
- Toast, Inc.: Form 10-K for fiscal year 2025 (filed 18 Feb 2026) (sec.gov), read on 2026-10-22
More processors and terminals: Payments & Card Data.