Square vs Clover: one is P2PE-listed, one is not
Published
For a small shop choosing a counter system, the PCI difference between Square and Clover comes down to one list. Clover has a validated point-to-point encryption (P2PE) solution on the PCI Security Standards Council's list, and the listing names its counter devices. Square has none. That decides which self-assessment questionnaire (SAQ) a counter can use. Square answers with a different promise: no validation to Square at all, on one condition. This page reads both lists, both providers' own words, and the Council's rules for each counter SAQ.
Square and Clover side by side
Each row is a question the standard raises at a counter, with the rule it maps to. “Ask the vendor” means the provider's own pages did not say when we read them on 2026-10-22.
Swipe sideways for more vendors
| What a counter needs | Square | Clover |
|---|---|---|
| Validated P2PE listing on PCI SSCSAQ P2PE | No | Yes |
| Card devices on the Council's PTS listPTS POI | Yes | Yes |
| Phone-and-reader setup on the SPoC listSAQ SPoC | No | No |
| States its own Level 1 statusReq. 12.8.4 | Yes | Ask the vendor |
| Says you need not validate to itValidation | Yes | No |
| Online help to complete your SAQSAQ | Not needed | Yes |
| Says it charges no PCI compliance feeFees | Yes | Ask the vendor |
| Breach liability waiver on offerBreach cover | Ask the vendor | Yes |
| Makes your business PCI compliant by itselfReq. 12.8.1 | No | No |
Each provider up close
Square
Payment processor and merchant of record for every sale, with its own readers, terminals, registers and point-of-sale apps.
FitsA shop or stall that keeps every card inside Square's own products
Validated P2PE listingNo
Says you need not validate to itYes
States its own Level 1 statusYes
Says it charges no PCI feeYes
Square lists “PCI Data Security Standard, Level 1” among its credentials and says “All card-present payments are encrypted from end to end.” Encrypted is not the same as listed: Square has no solution on the Council's P2PE list. Its parent, listed as “Block, Inc. (FKA Square, Inc.)”, holds 10 device approvals on the Council's PTS list, named by model code. Square payment security
VerdictEvery card kept inside Square and none on paper, from a counter to a phone-and-reader market stall
Clover
Clover Network's countertop, handheld and phone-reader POS on First Data processing, sold to retail, restaurant and service businesses.
FitsA retail counter ready to file SAQ P2PE on listed devices
Validated P2PE listingYes
Says you need not validate to itNo
States its own Level 1 statusAsk the vendor
Not stated on their site when read on 2026-10-22.
Says it charges no PCI feeAsk the vendor
Not stated on their site when read on 2026-10-22.
Clover's listing names its counter devices line by line. Its PCI guide says that with “PTS-certified equipment and P2PE encryption, you'll have very little to manage,” and that with Clover Security you get “a guided questionnaire to complete your SAQ.” Security Plus adds a “PCI Rapid Comply Solution” and a breach “liability waiver.” Clover Security Plus
Read that guide with care: it still calls PCI DSS 4.0 the most recent version. PCI DSS v4.0.1 is the version of the standard in force.
VerdictA counter that files SAQ P2PE on named, listed devices
Listed vs not listed
“A PCI-listed point-to-point encryption solution includes a combination of secure devices, applications and processes that encrypt cardholder data from a PCI-approved point-of-interaction (POI) device through to a secure decryption environment.” We read every page of the Council's list of validated P2PE solutions on 2026-10-22. The P2PE guide explains the parts.
Square
Entries for Square or Block, Inc.0
Solutions on the list138
StatusNot listed
Clover
Listed solutionClover
StandardP2PE v3.1
Reference2024-00893.006
Annual revalidation7 May 2027
Device lines named8
StatusListed, 2026-10-22
Clover's entry goes further than a name. It lists each card device the solution supports, with the device's PTS approval and the date that approval expires. That is the list to check your counter against, device by device. The Clover vs Toast page reads the same entry from a restaurant's side.
Swipe sideways for the expiry dates
| Device line in the listing | PTS approval | Approval expires |
|---|---|---|
| Clover Mini (2nd Generation)/C302; Clover Mini Enterprise/C303; Clover Station Pro Terminal/C503 | 4-10248 | 30 Apr 2027 |
| Clover Station, Clover Station Solo | 4-30298 | 30 Apr 2027 |
| Clover Station Printer with customer facing contactless payments | 4-30302 | 30 Apr 2027 |
| Flex | 4-40209 | 30 Apr 2027 |
| Clover Mini C305/Station Duo Terminal C505/Mini Terminal C506 | 4-40329 | 30 Apr 2032 |
| Clover Flex/C405 | 4-40338 | 30 Apr 2032 |
| Clover Companion (C800), Clover Compact (C801) | 4-60249 | 30 Apr 2032 |
| Clover Flex 4 (C406), Clover Flex 4 Pocket (C407) | 4-60250 | 30 Apr 2032 |
What it does to your SAQ
A counter merchant who files an SAQ picks it by how card data moves. SAQ P2PE is for “Merchants using only a validated, PCI-listed Point-to-Point Encryption (P2PE) solution. No access to clear-text account data and no electronic account data storage.” Without a listing, the road runs through the hardware: a standalone terminal may fit SAQ B-IP, a reader paired with a phone or iPad lands nearer SAQ C. Here are the counter SAQs against each provider.
Swipe sideways for both providers
| SAQ and the Council's test | Clover counter | Square counter |
|---|---|---|
| SAQ P2PECard data enters only payment terminals from a validated, PCI-listed P2PE solution. Paper only, nothing stored electronically. | OpenWhen every device is named in Clover's listing and you follow its PIM. | ClosedNo Square solution on the Council's P2PE list. |
| SAQ B-IPStandalone, PCI-listed PTS devices with their own IP link to the processor. Secure card readers (SCR, SCRP) and devices that lean on a phone, tablet or till are out. | Ask CloverRarely the question: listed devices point to SAQ P2PE first. | Ask SquareOnly a standalone device whose approval is not an SCRP. Readers on a phone or iPad are out. |
| SAQ CA payment application on an internet-connected device, linked to no other systems, one store only. | FallbackFor a device the listing does not name, such as the Go reader. | LikelyThe nearest fit for a Reader or Stand paired with a phone or iPad. |
| SAQ BImprint machines or standalone dial-out terminals that never connect to the internet. | NoNot a road for a device on Wi-Fi, Ethernet or cellular. | NoSquare says its devices need an internet connection. |
At the edges: if your stores share a network, SAQ C's “single store only” test fails, and if you keep card numbers electronically, you are in SAQ D territory: “All merchants not included in descriptions for the above SAQ types.” The SAQ type finder walks the same questions for your whole business.
Check your counter
Tick the devices you run. The check matches Clover devices to the listing lines above, and sorts Square devices by whether they reach the processor on their own or through a phone or tablet.
Pick the provider, then tick every card device on your counter. Pre-filled with a typical shop.
Devices ticked2
Named in a Council P2PE listing2
Earliest device approval expiry30 Apr 2027
RoadSAQ P2PE
Every device you ticked is named in Clover's P2PE listing. SAQ P2PE fits if they are the only systems that handle card data and you carry out every control in Clover's P2PE Instruction Manual (PIM). Match each device's model code to the listing line, then confirm with your acquirer.
- Station Solo: 4-30298, PTS approval to 30 Apr 2027
- Flex: 4-40209, PTS approval to 30 Apr 2027
- Flex: 4-40338, PTS approval to 30 Apr 2032
- Flex: 4-60250, PTS approval to 30 Apr 2032
Square's condition, read closely
Square's promise is real and it is conditional. Read the second sentence as closely as the first.
“As the merchant of record, we maintain PCI certification so you don’t have to individually validate your compliance.”
“Provided you use Square for all storage, processing, and transmission of your customers’ card data, you don’t need to take any steps to validate your PCI compliance to Square, and you don’t need to pay any PCI-compliance fees.”
Square, Payment security and PCI Compliance: Everything You Need to Know
The condition, word by word
Storageoutside Square
A card number written on a special-order slip, or saved in a customer note for a layaway.
Processingoutside Square
A second terminal from another provider, kept for one kind of sale.
Transmissionoutside Square
Card details a customer emails or texts to you for a phone order.
Any one of thesebreaks the condition
Paper slips and saved notes are the usual leak at a shop counter; the guide to storing card information covers what you may keep. And the promise covers validation to Square, not compliance itself: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” How Square's model compares with a processor that maps each setup to an SAQ is on Stripe vs Square.
What each says about PCI fees
Neither provider prints a PCI fee amount on the pages we read, and we print none here. What each says, in its own words:
Square
- “No expensive audits, assessments, or noncompliance fees.” Payment security
- “Our hardware and readers have end-to-end encryption out of the box, with no configuration required and at no additional cost, without monthly fees or annual assessment requirements.” PCI compliance article
Its own PCI feeNone, on its condition
Clover
- “Of course, there are direct PCI compliance fees – normally calculated and charged by your payment processor.” What is PCI compliance?
- “Contact us today to learn how you can get started with Clover Security Plus.” Clover Security Plus
Its own PCI feeAsk Clover
A PCI non-compliance fee on a merchant statement comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council. Ask Clover for its fee schedule before you sign. The PCI compliance fees guide explains the lines you may see.
Questions retailers ask
Square says its readers are encrypted end to end. Isn't that P2PE?
Not for your paperwork. A PCI-listed P2PE solution “can significantly help to reduce the PCI DSS validation effort of a merchant's cardholder data environment.” Only a solution on the Council's list qualifies a merchant for SAQ P2PE; an “encrypted reader” that is not listed does not. The encryption may be strong; the listing is what the questionnaire asks about. How P2PE listing works.
With Square, do I file an SAQ at all?
Square says no, on its condition: “Provided you use Square for all storage, processing, and transmission of your customers’ card data, you don’t need to take any steps to validate your PCI compliance to Square.” The Council notes that validation rules are set by “brands, acquirers, payment facilitators, etc.,” so Square may decide what it asks of you.
Not filing is not the same as being compliant: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” More in is Square PCI compliant.
Which Clover devices are in the listing?
The Council's entry names Station and Station Solo, Station Duo's terminal, Mini and Flex across generations, Flex 4 Pocket, and Compact with Companion, each with a PTS approval number and expiry. We did not find Clover Go or Clover Kiosk among the named devices. Model codes such as C406 are how the listing tells generations apart, so ask Clover which code your device carries.
I added a Clover Go for the sidewalk sale. Does that break SAQ P2PE?
It can. One SAQ P2PE criterion is that “The only systems in the merchant environment that store, process, or transmit account data are the payment terminals from a validated PCI-listed P2PE solution.” A reader the listing does not name is outside that, so ask Clover first, and check the scope checker for what else is in play.
Who gets my SAQ if I use Clover?
Before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. The attestation of compliance guide covers the form you sign with it.
Sources
- PCI SSC: Validated P2PE Solutions list (incl. the Clover solution's device details) (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Approved PIN Transaction Security (PTS) devices list (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Validated SPoC Solutions list (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: SAQ Instructions and Guidelines v4.0.1 r1 (April 2025) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: At a Glance, P2PE v3 (July 2020) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (Req. 12.8.1) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC blog: Important updates for merchants validating to SAQ A (blog.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: At a Glance, the role of the PCI SSC (listings.pcisecuritystandards.org), read on 2026-10-22
- Visa: Security and compliance (corporate.visa.com), read on 2026-10-22
- Square: Payment security (squareup.com), read on 2026-10-22
- Square: PCI Compliance: Everything You Need to Know (squareup.com), read on 2026-10-22
- Square: Reader for contactless and chip (squareup.com), read on 2026-10-22
- Square: Stand (squareup.com), read on 2026-10-22
- Square: Terminal (squareup.com), read on 2026-10-22
- Square: Register (squareup.com), read on 2026-10-22
- Square: Handheld (squareup.com), read on 2026-10-22
- Clover: Clover Security Plus (clover.com), read on 2026-10-22
- Clover: What is PCI compliance? (blog.clover.com), read on 2026-10-22
- Clover: Go (clover.com), read on 2026-10-22
More processors and terminals: Payments & Card Data.