PCI compliant virtual terminals, compared on SAQ C-VT
Published
A virtual terminal is a page on your provider’s website where staff type in a card that a customer reads out over the phone, writes on an order form or hands over when the reader is down. The questionnaire written for it is SAQ C-VT: “Merchants that manually enter payment account data a single transaction at a time via a keyboard into a PCI DSS validated and compliant third-party virtual payment terminal solution, with an isolated computing device and a securely connected web browser. No electronic account data storage.” No card reader may be attached to that computer. The provider can only supply the first half of that sentence. This page compares the terminals on that half and shows what the second half asks of your desk.
Verdict
- Best overall for a phone and mail order deskHelcim
- Best for a counter shop that keys the odd orderClover
- Best for repeat billing from saved cardsAuthorize.net
- Best for an online business keying a rare orderStripe
Vendors compared6
Virtual terminals, row by row
Each row is a question SAQ C-VT or the standard makes you answer about a provider, with the criterion or requirement it maps to. “Ask the vendor” means the provider’s own pages did not say when we read them on 2026-10-22. Stripe’s column is its Dashboard, which takes manual card entry; the rest are products their makers call a Virtual Terminal.
Swipe sideways for more vendors
| What you need | Our pickHelcim | Square | PayPal | Authorize.net | Clover | Stripe |
|---|---|---|---|---|---|---|
| Browser terminal for keyed card paymentsSAQ C-VT | Yes | Yes | Yes | Yes | Yes | Yes |
| States its own PCI DSS complianceReq. 12.8.4 | Yes | Yes | Yes | Yes | Ask the vendor | Yes |
| Names SAQ C-VT for its terminalSAQ eligibility | Yes | Ask the vendor | Ask the vendor | Ask the vendor | Ask the vendor | Yes |
| Pitched for routine phone and mail ordersVendor guidance | Yes | Yes | Yes | Yes | Yes | No |
| Saves a repeat customer's card on its sideNo storage on yours | Yes | Yes | Ask the vendor | Yes | Yes | Ask the vendor |
| Says the keying computer is your jobIsolation criterion | Ask the vendor | Ask the vendor | Yes | Ask the vendor | Ask the vendor | Yes |
| Counter reader on the Council's P2PE listSAQ P2PE | No | No | Yes | Ask the vendor | Yes | Yes |
| Makes your business PCI compliant by itselfReq. 12.8.1 | No | No | No | No | No | No |
Read down the columns. On the pages we read, only Helcim and Stripe name SAQ C-VT, and Stripe tells you not to use its Dashboard for routine orders. And on the row that matters most, the keying computer, only PayPal and Stripe say plainly that it is yours. It is yours with every provider.
The SAQ C-VT test, in full
Most summaries stop at “no card data stored.” The Council’s list is longer, and only the second criterion is about the provider at all. The rest are about the computer, the network and how card numbers reach you. Here is the whole list in the Council’s words, with what breaks each line at a real desk.
SAQ C-VT eligibility
SAQ Instructions v4.0.1 r1, p. 19
“This SAQ option is intended to apply only to merchants that manually enter a single transaction at a time via a keyboard into an Internet-based virtual payment terminal solution.”
- 01
“The only payment processing is via a virtual payment terminal accessed by an Internet-connected web browser;”
At the desk A payment app, a till program or a reader app on the same computer is a second way of processing.
- 02
“The virtual payment terminal solution is provided and hosted by a PCI DSS compliant third-party service provider;”
At the desk Check the provider's own compliance statement, and list it under Requirement 12.8.1.
- 03
“The PCI DSS compliant virtual payment terminal solution is only accessed via a computing device that is isolated in a single location, and is not connected to other locations or systems (this can be achieved via a firewall or network segmentation to isolate the merchant system(s) accessing the virtual payment terminal from other merchant systems);”
At the desk A link to the till, the booking server or a second shop fails it. The Council names connections to cash register systems.
- 04
“The computing device does not have software installed that causes account data to be stored (for example, there is no software for batch processing or store-and-forward);”
At the desk Batch tools, offline store-and-forward modes and anything that saves a typed card number fail it.
- 05
“The computing device does not have any attached hardware devices that are used to capture or store account data (for example, there are no card readers attached);”
At the desk A card reader plugged into or paired with the keying computer fails it, even if staff mostly type.
- 06
“The merchant does not otherwise receive, transmit, or store account data electronically through any channels (for example, via an internal network or the Internet); and”
At the desk Card numbers sent by email, text, chat, fax-to-email or a shared spreadsheet fail it, on any computer.
- 07
“Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically.”
At the desk Order slips and signed forms stay on paper, kept locked, and are shredded when no longer needed.
Footnote 3, p. 19: “This criteria is not intended to prohibit more than one of the permitted system type (that is, Internet-connected web browser accessing a virtual payment terminal solution) being on the same network zone, as long as the permitted systems are isolated from other types of systems (for example, by implementing network segmentation).”
p. 13 names connections that fail the test, including “connections to cash register systems, and if the virtual payment terminal relies on any other device to connect to the virtual payment terminal solution provider.”
Criteria7
Which one fits your desk
The right terminal depends on what the desk is for, and the right form depends on what else is on it. Pick the desk, switch on anything else that happens there, and the map shows which connections cross the SAQ C-VT line. The shortlist under it reads each provider’s own page against that kind of desk.
Which virtual terminal fits your desk
Pick the desk, then switch on anything else that happens there. Pre-set to a phone-order desk where some customers email their card numbers.
Form this desk points toNot SAQ C-VT as set up
Breaks “does not otherwise receive, transmit, or store account data electronically”
Stop taking card numbers in writing online: call the customer back or send the provider's payment link.
Shortlist for this desk
HelcimStrong fit
Its docs map the Virtual Terminal to SAQ C-VT, made for “payments taken over the phone.”
SquareFits
It is “perfect for remote billing or taking credit cards over the phone.” Names no SAQ.
PayPalFits
Takes “phone orders” and says you secure “the device and browser.” Names no SAQ.
Authorize.netFits
“Submit manual orders quickly and securely with our Virtual Terminal using your web browser.”
CloverFits
Pitched for “in-store orders, mail orders, or invoices” from the Clover dashboard.
StripeWeak fit
Dashboard keying is “for exceptional circumstances only, not routine payment processing.”
Phone orders are only one way in. If staff should never hear a card number at all, the phone payment options compare keypad-entry and payment-link set-ups that keep it off the desk entirely.
Features to read twice
A provider’s product page sells everything it offers, and some of it sits outside SAQ C-VT. These are the features on the pages we read that change the form, either by putting card data on your side or by taking it off your keyboard altogether.
Features to read twice
Authorize.net VPOSOutside C-VT
“Install the Windows Authorize.net 2.0 app, connect a supported card reader”
An installed app plus a reader on the computer: SAQ C-VT allows neither.
Authorize.net Batch UploadOutside C-VT
“upload multiple credit card or echeck transactions in a single file”
SAQ C-VT is for “a single transaction at a time via a keyboard,” with no batch software.
Square Remote paymentsOutside C-VT
“remote payments by phone, mail, email, or text”
If what reaches you by email or text is the card number itself, criterion 06 fails. A payment link is different.
Square Payment linksOff your keyboard
“send a payment link via text so your customers can pay privately”
The customer types the card into Square’s page, not into your computer. Ask your acquirer which form covers it.
Stripe Phone pay connectorsOff your keyboard
“the user should not have access to the card data”
Stripe maps a third-party phone connector to SAQ A, not SAQ C-VT.
Authorize.net is the clearest case: its Virtual Terminal fits a keyed desk, while its VPOS app and Batch Upload, sold on neighbouring pages, do not. The Authorize.net vs Stripe comparison puts the gateway’s online and phone routes side by side.
The provider’s half and yours
The Council describes the split itself: the merchant keys card data “from an isolated computing device via a securely connected web browser,” and the transactions “are submitted for authorization by the PCI DSS compliant third-party service provider that is hosting the virtual payment terminal solution.” Everything on the left receipt is the provider’s; everything on the right is yours, whichever provider you pick.
The provider's half
- Hosts the terminal page you type intoC-VT 02
- Submits each payment for authorizationp. 13
- Keeps any saved card in its own vaultReq. 12.8.5
- Keeps its own PCI DSS complianceReq. 12.8.4
Hosted byThe provider
Your desk's half
- A computer kept apart from the till and other systemsC-VT 03
- No reader, no batch or store-and-forward softwareC-VT 04–05
- No card numbers by email, text or chatC-VT 06
- Paper slips locked away, then shreddedReq. 9.4.6
- No card verification code kept after authorizationReq. 3.3.1.2
- The provider on your list of service providersReq. 12.8.1
Files the SAQYou
Requirement 12.8.4 asks for “A program” to monitor each provider’s “PCI DSS compliance status at least once every 12 months,” so the compliance statements quoted below are worth saving each year. Square’s version carries a condition worth reading in full; the Square PCI guide walks through it.
Each terminal on its own
Helcim
Payment processor with a browser Virtual Terminal, its own card readers, invoices and hosted payment pages.
FitsOffices and service businesses keying phone, mail and invoice payments
Names SAQ C-VT for its terminalYes
Saves a repeat customer's card on its sideYes
Pitched for routine phone and mail ordersYes
Counter reader on the Council's P2PE listNo
Helcim calls the Virtual Terminal “like having a cash register in your web browser,” made for “payments taken over the phone, or for billing stored credit card information for a recurring payment.”
Its PCI help table maps the Virtual Terminal to SAQ C-VT and marks that form as supported by its automated questionnaire. Its security page says “Helcim is a PCI Level 1 Service Provider.”
VerdictA phone and mail order desk
Square
Payment processor and merchant of record, with Square Virtual Terminal in the Square Dashboard.
FitsSquare sellers keying phone, mail and counter orders from a computer
Names SAQ C-VT for its terminalAsk the vendor
Not stated on their site when read on 2026-10-22.
Saves a repeat customer's card on its sideYes
Pitched for routine phone and mail ordersYes
Counter reader on the Council's P2PE listNo
Square Virtual Terminal “turns your computer into a credit card terminal,” and “No additional devices or special equipment is required to start taking payments with Square Virtual Terminal.” Square names no SAQ for it.
“As the merchant of record, we maintain PCI certification so you don’t have to individually validate your compliance,” Square says, with a condition: “Provided you use Square for all storage, processing, and transmission of your customers’ card data, you don’t need to take any steps to validate your PCI compliance to Square, and you don’t need to pay any PCI-compliance fees.” Requirement 12.8.1 adds: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity’s responsibility for its own PCI DSS compliance.”
VerdictA Square shop keying orders at the same desk
PayPal
Virtual Terminal inside a PayPal business account, beside invoicing and online checkout.
FitsFreelancers, trades, health providers and nonprofits taking phone and mail orders
Names SAQ C-VT for its terminalAsk the vendor
Not stated on their site when read on 2026-10-22.
Saves a repeat customer's card on its sideAsk the vendor
Not stated on their site when read on 2026-10-22.
Pitched for routine phone and mail ordersYes
Counter reader on the Council's P2PE listYes
PayPal’s own answer: “Yes. PayPal’s virtual payment terminal is PCI compliant.” Then: “You are responsible for securing the device and browser used to access the terminal.” That second sentence is SAQ C-VT’s isolation criterion in plain words. PayPal names no SAQ for the terminal.
PayPal Braintree In-Person, a PayPal Inc listing, is on the Council’s P2PE list.
VerdictPhone and mail orders in an existing PayPal account
Authorize.net
Payment gateway with a browser Virtual Terminal, Batch Upload, recurring billing and the VPOS reader app.
FitsBusinesses billing the same customers on a schedule
Names SAQ C-VT for its terminalAsk the vendor
Not stated on their site when read on 2026-10-22.
Saves a repeat customer's card on its sideYes
Pitched for routine phone and mail ordersYes
Counter reader on the Council's P2PE listAsk the vendor
Not stated on their site when read on 2026-10-22.
“Authorize.net is a PCI DSS Level 1 Service Provider,” its pricing page says. Its Customer Information Manager keeps payment details “on Authorize.net’s PCI-DSS-compliant servers,” and “Sensitive card data never touches your servers.”
The Virtual Terminal fits the keyed desk. Batch Upload and VPOS do not: both are in the features to read twice, below. Authorize.net names no SAQ for the terminal.
VerdictRepeat billing from saved cards
Clover
Point-of-sale system whose Virtual Terminal comes on the Clover web dashboard.
FitsClover counter shops that also take mail orders and invoices
Names SAQ C-VT for its terminalAsk the vendor
Not stated on their site when read on 2026-10-22.
Saves a repeat customer's card on its sideYes
Pitched for routine phone and mail ordersYes
Counter reader on the Council's P2PE listYes
“We keep you PCI compliant and secure with end-to-end encryption,” Clover’s terminal page says, and the terminal can “Securely store your regular customers’ card information for faster transactions.” Requirement 12.8.1 sets the limit on the first claim: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity’s responsibility for its own PCI DSS compliance.”
Its counter solution, listed as “Clover,” is on the Council’s P2PE list. Clover names no SAQ for the Virtual Terminal, and its own compliance level is not stated on the pages we read.
VerdictA counter shop that keys the odd order
Stripe
Online payments platform; its Dashboard takes manual card entry.
FitsOnline businesses keying an occasional phone order
Names SAQ C-VT for its terminalYes
Saves a repeat customer's card on its sideAsk the vendor
Not stated on their site when read on 2026-10-22.
Pitched for routine phone and mail ordersNo
Counter reader on the Council's P2PE listYes
Stripe maps the Dashboard to SAQ C-VT: “Manual card payments through the Dashboard are possible for exceptional circumstances only, not routine payment processing.” It adds that it “can’t verify that manually entered card information is secure outside of Stripe, so you must protect card data.”
Stripe says an auditor “certified us to PCI Service Provider Level 1,” and Stripe Terminal P2PE is on the Council’s list.
VerdictAn online business keying a rare order
For head-to-head pages, see Helcim vs Square, which also checks a keying computer against the criteria, and Square vs Clover for the counter side. If you key cards into QuickBooks, the same test is applied to it in is QuickBooks PCI compliant.
Questions merchants ask
Is a virtual terminal PCI compliant on its own?
The provider’s half can be. Every terminal in the table runs on the provider’s systems, and most of the providers state their own compliance. Your half is the computer, the browser and the paper. PayPal says it outright: “You are responsible for securing the device and browser used to access the terminal.”
Requirement 12.8.1 puts it formally: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity’s responsibility for its own PCI DSS compliance.”
Can the keying computer also run email and the booking system?
The Council’s test is about connections and card data: the computer must be “isolated in a single location, and is not connected to other locations or systems,” and it names “connections to cash register systems” as one that fails. Several keying computers may share one network zone if they are isolated from other kinds of systems. The simplest way to pass is a computer that does nothing but key payments, on its own network segment; the firewall guide shows how a small shop sets that up.
Can I keep a repeat customer's card for next time?
Keep it in the provider’s saved-card tool, not in your files. SAQ C-VT allows card data on your side only on paper, “not received electronically.” If you keep a signed card authorization form, Requirement 3.3.1.2 still applies: “The card verification code is not stored upon completion of the authorization process.” Paper you no longer need is “cross-cut shredded, incinerated, or pulped” under Requirement 9.4.6. More in storing credit card information.
What if I key phone orders into my counter terminal instead?
Then the browser is out of the picture, and so is SAQ C-VT. The Council says a mail or telephone order merchant “could be eligible for SAQ P2PE if they receive account data on paper or over a telephone, and key it directly and only into payment terminal from a validated PCI-listed P2PE solution.” That only works with a solution on the Council’s list; the P2PE guide explains how to check one.
I also sell online. Does SAQ C-VT cover that?
No. The Council says SAQ C-VT “is not applicable to e-commerce channels.” Each channel gets its own form; Stripe’s guide says that with several methods “you must illustrate compliance for them separately.” The SAQ type finder works through each channel, and the SAQ types guide lays the forms side by side.
Why is Stax not in the table?
Stax’s docs describe it as “a Level 1 PCI Service Provider,” but its main site blocked our reader on the day we checked, and the docs we could read describe no browser terminal. A column needs the vendor’s own page to confirm the product, so Stax has none here. If you use Stax, ask it directly what it offers for keyed payments and which SAQ it expects.
Sources
- PCI SSC: SAQ Instructions and Guidelines, PCI DSS v4.0.1 r1 (pp. 13, 14, 19, 21) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (Req. 3.3.1.2, 9.4.6, 12.8.1, 12.8.4) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Validated P2PE Solutions list (pcisecuritystandards.org), read on 2026-10-22
- Helcim help: What is the Helcim Virtual Terminal? (learn.helcim.com), read on 2026-10-22
- Helcim help: Manually submitting your PCI compliance (SAQ types overview) (learn.helcim.com), read on 2026-10-22
- Helcim: Security (helcim.com), read on 2026-10-22
- Square: Virtual Terminal (squareup.com), read on 2026-10-22
- Square: Payment security (squareup.com), read on 2026-10-22
- Square: PCI Compliance: Everything You Need to Know (squareup.com), read on 2026-10-22
- PayPal: Virtual Terminal (paypal.com), read on 2026-10-22
- Authorize.net: Accept phone payments (Virtual Terminal, Batch Upload) (authorize.net), read on 2026-10-22
- Authorize.net: Virtual point of sale (VPOS) (authorize.net), read on 2026-10-22
- Authorize.net: Recurring payments (Customer Information Manager) (authorize.net), read on 2026-10-22
- Authorize.net: Pricing (PCI FAQ) (authorize.net), read on 2026-10-22
- Clover: Virtual Terminal for Payment Processing (clover.com), read on 2026-10-22
- Stripe: A guide to PCI compliance (integration table and MOTO section) (stripe.com), read on 2026-10-22
- Stripe docs: Integration security guide (PCI Service Provider Level 1) (docs.stripe.com), read on 2026-10-22
- Stax docs: Overview of PCI Compliance (docs.staxpayments.com), read on 2026-10-22