The best payment gateway for a small business, judged by the SAQ it leaves you on

The gateways side by side

Each row is something the standard asks of you or of the gateway, phrased as a shop owner would ask it. “Ask the vendor” means the gateway's own pages did not say so when we read them on 2026-10-22. It does not mean no. The opening rows are about how you connect, and the next section shows why that matters most.

The pattern: the gateways that publish developer docs (Stripe, Braintree, Authorize.net) name the SAQ for each integration; on the pages we read, the all-in-one systems did not. If your developer is choosing between them, the Authorize.net vs Stripe comparison goes route by route.

How you connect sets your SAQ

The Council's test is one sentence: if any element of the payment page delivered to the shopper's browser comes from the merchant's own website, SAQ A does not apply; SAQ A-EP may. A redirect to the processor's page, or an iframe from the processor, can fit SAQ A. The gap between those routes is not small.

Pick your setup below to see the SAQ it points to and what each gateway's own docs say about it. If you are unsure which one you run, the SAQ type finder asks plain questions about how you take cards, and the guide to every SAQ type sets them side by side.

Gateway by gateway

Weighing the two most common names? The PCI side alone is set out in Stripe vs Square. Selling on Shopify rather than a site you build? See Shopify Payments vs Stripe.

Phone and mail orders

6 of the 7 gateways offer the same answer to a phone order: a virtual terminal, a browser page where staff key in one card at a time. That route has its own questionnaire, SAQ C-VT, written for “Merchants that manually enter payment account data a single transaction at a time via a keyboard into a PCI DSS validated and compliant third-party virtual payment terminal solution, with an isolated computing device and a securely connected web browser.”

Stripe allows manual entry in its Dashboard but calls it “for exceptional circumstances only.” For phone orders its guide also names a pay-connector route on SAQ A, where a third-party phone service collects the card and the merchant “should not have access to the card data.” PayPal (Braintree), Authorize.net, Square, Helcim, and Clover each have a dedicated virtual terminal page. For Stax we could not confirm one on their own sites, so ask the vendor. Shops with a call center should also read the phone payment services that keep card numbers off your line and the full virtual terminal comparison.

At the counter: the P2PE list

For card-present sales the shortest questionnaire is SAQ P2PE, and it has one gate: “Merchants using only a validated, PCI-listed Point-to-Point Encryption (P2PE) solution.” The Council says a listed solution “can significantly help to reduce the PCI DSS validation effort of a merchant's cardholder data environment,” and only a solution on its list qualifies. An “encrypted reader” that is not listed does not.

Being on the list is the vendor's part. Your part is using only that solution, as listed, at every till. The guide to P2PE versus an encrypted reader explains why the listing matters, and Square vs Clover walks the difference for a small retail counter.

Questions to ask before you sign

The paper a gateway can hand you is its Attestation of Compliance: “the official PCI SSC form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in a Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC).” On the pages we read, only Stripe, Authorize.net, and Square said where to find it. The rest may well share it on request, so ask. Our guide to the Attestation of Compliance covers which one you send and which ones you collect.

Before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. The gateway's answer helps; the acquirer's answer is the one that counts.

Questions