Stax vs Square: who runs your PCI program, and what skipping it costs

The PCI side, row by row

Each row is a question the standard makes you answer about a provider, with the requirement or form it maps to. “Ask the vendor” means the provider’s own pages did not say when we read them on 2026-10-22. Square’s “No” on yearly validation holds only on its condition, covered below.

A program or a waiver

Stax prices its subscription on “the volume of credit and debit card payments your business accepts each year.” Its PCI side is a yearly routine in a portal: verify your merchant information, complete the SAQ, complete an ASV scan if your SAQ requires one, then review and sign. Square folds PCI into being the merchant of record: while every card stays in its products, it asks you to file nothing.

The difference is who files. With Stax you file, through a portal Stax hands you, and the program keeps the certificate and the scans on a calendar. Stax’s help pages also say breach insurance is included “with the Aperia Compliance PCI program”; ask Stax whether your account is on that program and what the cover holds. With Square there is nothing to file to Square, and nothing to keep on a calendar for Square either.

Stax’s 90-day clock

Stax’s rule is a date: “Merchants have 90 days from when their new merchant account is APPROVED with Stax to become PCI compliant.” After that, Stax’s PCI non-compliance fee applies until you are. A PCI non-compliance fee on a merchant statement comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council, which is why the amount is a question for Stax. Square’s payment security page promises “No expensive audits, assessments, or noncompliance fees,” under the same condition as its validation claim. The PCI compliance fees guide covers who may bill you and why.

Scans: who books them

PCI DSS 11.3.2 requires external vulnerability scans at least once every three months by an ASV approved by PCI SSC. Stax’s help pages build that into the portal: a Network Scanning page where you add your IP address or domain, launch a scan “performed by an Approved Scanning Vendor (ASV)”, and schedule it to repeat quarterly. Stax’s docs put a typical scan at 24 to 48 hours. Aperia, whose portal some Stax accounts use, is on the Council’s ASV list. Square’s PCI article mentions ASV scans only in a general table of merchant levels and does not say whether Square runs them for you or whether its sellers need them; ask Square, above all if any card flow sits outside it.

Stax’s help pages do not all describe which setups need a scan in the same words, so go by the form. SAQ A for v4.x includes Requirements 11.3.2 and 11.3.2.1 (external vulnerability scans) for merchants whose pages redirect to, or embed, a processor’s payment page. Stax’s own PCI Scans page agrees: “If you are an e-commerce merchant using redirects or iframes, you now must perform quarterly ASV scans.” The ASV scan guide explains passing and failing, and ASV scanning vendors compared covers scanners you hire yourself.

Where Square’s condition stops

Square’s waiver is worded with care: “Provided you use Square for all storage, processing, and transmission of your customers’ card data, you don’t need to take any steps to validate your PCI compliance to Square, and you don’t need to pay any PCI-compliance fees.” It ends where card data leaves Square. A salon that takes a deposit by phone and writes the number in the appointment book has card data outside Square, and PCI DSS applies to that part whatever Square asks of you. Our reading, flow by flow:

If a line reads “You”, ask Square what it expects from you for that part, and find the form that fits with the SAQ type finder. Before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. Stax’s portal builds the questionnaire from your answers about how you take cards, so a flow outside the processor lands on a form there too. The safest fix is to stop keeping card numbers at all; the guide to storing card details shows what the rules allow.

Each provider on its own

What you still own

“The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity’s responsibility for its own PCI DSS compliance.” Stax and Square are third-party service providers. Stax hands you a program and Square waives its paperwork; the duties below stay with you under either.

Walk the PCI compliance checklist once a year whichever you choose. If you are still choosing, the Stripe vs Square page and the PCI compliant payment gateways table set more processors on the same rows.

Questions merchants ask