Toast vs Square: who does the PCI work in a restaurant
Published
Toast and Square give a restaurant owner the same headline answer: you will probably file nothing with us. Both are the payments company in the middle, not just the software, and both say they carry most of the PCI DSS work. The difference is in the small print. Toast names the one requirement it leaves with card-present restaurants on its devices. Square states one condition, that every card number stays inside Square. Toast's P2PE solution is also on the PCI Security Standards Council's list of validated P2PE solutions, and Square has none there. Neither one makes your restaurant compliant for you.
Two “nothing to file” claims
Each provider sits between you and the card networks. Toast says it is “registered as a payment facilitator”; Square says it is “the merchant of record for every transaction.” That position is why either can tell you what to file. In the Council's words, “Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.” Here is what each one says.
Toast says
- “Most Toast customers do not need to submit such PCI compliance documentation or engage a company to complete vulnerability scans.”
- “For card-present transactions using Toast-approved devices and the Toast Platform, the only section of the Toast PCI Responsibility Matrix (Card Present) with requirements you need to meet is Requirement 9: Restrict Physical Access to Cardholder Data.”
Rests on: Toast-approved devices and the Toast Platform; the full split is in Responsibility Guides you request from Toast.
Toast: PCI Compliance Overview, read 2026-10-24
How it tells you your shareNamed requirement
Square says
- “As the merchant of record, we maintain PCI certification so you don’t have to individually validate your compliance.”
- “Provided you use Square for all storage, processing, and transmission of your customers’ card data, you don’t need to take any steps to validate your PCI compliance to Square, and you don’t need to pay any PCI-compliance fees.”
Rests on: Every card number staying inside Square: no paper pad, no saved notes, no second processor.
Square: Payment security and Square: PCI Compliance, read 2026-10-24
How it tells you your shareOne condition
Read side by side, Toast tells you your share as a requirement number and Square tells you as a habit to keep. The Square PCI guide tests Square's condition against the habits that usually break it.
Toast POS vs Square, side by side
Each row is a question the rule raises. “Ask the vendor” means their own pages did not say.
Swipe sideways for more vendors
| What a restaurant needs | Toast | Square |
|---|---|---|
| Sits between you and the bank as the payments companyValidation | Yes | Yes |
| States its own Level 1 statusReq. 12.8.4 | Yes | Yes |
| Says you file little or nothing with itSAQ | Yes | Yes |
| Publicly names which requirements stay yoursReq. 12.8.5 | Yes | Ask the vendor |
| Says its own online ordering is covered tooE-commerce | Yes | Ask the vendor |
| Validated P2PE listing on PCI SSCSAQ P2PE | Yes | No |
| Says how cards taken offline are heldReq. 3.5.1 | Yes | Yes |
| Blocks keyed card numbers while offlineReq. 3.5.1 | Ask the vendor | Yes |
| Makes your restaurant PCI compliant by itselfReq. 12.8.1 | No | No |
Walk one service on each
The claims are easiest to test against a real night. Pick a moment and read what each provider says about it, with the rule that applies whichever one you run. During an internet outage both hold cards on the device and both leave declined and disputed offline payments with you (Toast's offline help, Square's offline help). The one difference they state: Square says keyed card numbers are not available offline, and Toast's pages we read do not say either way.
One dinner service, six moments
Tap a moment. It starts at the counter.
A guest dips a card at the counter terminal.
ToastProvider’s side
Card-present payments on Toast-approved devices: “the only section of the Toast PCI Responsibility Matrix (Card Present) with requirements you need to meet is Requirement 9.”
Read from: Toast support
SquareProvider’s side
“Our hardware and readers have end-to-end encryption out of the box, with no configuration required.”
Read from: Square PCI article
Requirement 9 restricts physical access to cardholder data: the terminals themselves stay in your care.Req. 9
Moments left on your sideToast 2, Square 2
Left open (ask the vendor): Toast 0, Square 1.
The catering call is the moment that catches restaurants on both systems. If card numbers arrive by phone, key them straight into the POS, and read phone payments compared if call volume is high.
Where the P2PE listing still counts
When nobody asks you for a questionnaire, a P2PE listing does little day to day. It counts the day an acquirer or a new processor does ask. SAQ P2PE is for “Merchants using only a validated, PCI-listed Point-to-Point Encryption (P2PE) solution,” and it is not for e-commerce. On the Council's P2PE list on 2026-10-24, “Toast P2PE” sits under Bluefin Payment Systems; no entry carries Square's or Block's name. For a reader that is not listed, the reduction is “determined by the merchant's acquirer and payment brands.”
Toast's listing, line by line, is on Clover vs Toast. What Square's readers do instead is on Square vs Clover.
Each provider up close
Toast
A POS and payments platform built for restaurants and food and beverage retailers, on Toast's own hardware.
FitsA full-service or quick-service restaurant that takes every card on Toast devices
Level 1 service provider statementYes
Public note of what stays yoursYes
Validated P2PE listingYes
Blocks keyed cards offlineAsk the vendor
Not stated on their site when read on 2026-10-24.
Toast's annual report says it is “registered as a payment facilitator or certified service provider with the Payment Networks” and that “Toast is a PCI-DSS compliant Level 1 Service Provider.” Toast Form 10-K
The Responsibility Guides behind its support article are sent on request, so ask Customer Care for the one that matches each way you take cards before you rely on the Requirement 9 summary.
VerdictRestaurants that want their share named
Square
A POS and payments platform for restaurants, retail and appointment businesses, with Square as the merchant of record.
FitsA café or counter that also sells retail or books appointments
Level 1 service provider statementYes
Public note of what stays yoursAsk the vendor
Not stated on their site when read on 2026-10-24.
Validated P2PE listingNo
Blocks keyed cards offlineYes
Square lists “PCI Data Security Standard, Level 1” among its credentials (Square: Payment security) and says “We deal with the banks on your behalf, including for PCI compliance, regulation, and processing” (its PCI article).
Its promise holds only while every card number stays inside Square. The restaurant POS page lists the handhelds, kiosks and online ordering that keep it there.
VerdictMixed businesses on one account
What stays yours on either
“The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” With Toast or Square, four jobs stay at your restaurant:
- Look after the terminals and handhelds, which Requirement 9 covers, and keep paper with card numbers locked away until it is “cross-cut shredded, incinerated, or pulped” (Req. 9.4.6).
- Keep a list of your service providers: the POS, any separate ordering app, any second processor (Req. 12.8.1).
- Know “which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared” (Req. 12.8.5). With Toast, that is the Responsibility Guide you request; with Square, ask for its written split.
- Never save card numbers in reservation notes or emails. The guide to storing card data covers what you may keep.
Square vs Toast: questions owners ask
Square vs Toast: which leaves a restaurant less PCI paperwork?
On their own words, about the same: both say you file little or nothing with them. The difference is how each tells you what is left. Toast names one requirement for card-present payments on its devices, Requirement 9. Square states one condition: every card number stays inside Square.
Which one is lighter for you depends on the habits you already have. A catering pad or a second processor breaks Square's condition, and it adds to the Requirement 9 work Toast leaves with you.
Do I need to file an SAQ with Toast?
Toast says “most Toast customers do not need to submit such PCI compliance documentation or engage a company to complete vulnerability scans,” and that it “does not send out emails asking you to complete any of these documents.”
If another provider asks you for an SAQ, Toast says its devices do not belong in that report, “since our devices can only be used to process guest payment card data using Toast's merchant processing services.”
Does Square's promise cover a third-party online ordering app?
Square's condition is “provided you use Square for all storage, processing, and transmission of your customers' card data.” An app that takes the card itself sits outside that sentence, so ask Square and the app which of them handles the card and what each expects from you. The Square guide reads the condition line by line.
Toast is P2PE listed and Square is not. Does that matter if nobody asks me to file?
It matters the day someone does ask. A listed solution is what SAQ P2PE is built on: “Merchants using only a validated, PCI-listed Point-to-Point Encryption (P2PE) solution.” Toast's listing is “Toast P2PE,” held by Bluefin Payment Systems.
For a reader that is not listed, “what, if any, PCI DSS validation reduction is permitted … is determined by the merchant's acquirer and payment brands.” The P2PE guide explains the difference.
If neither one asks me to file anything, am I PCI compliant?
Not automatically. The Council says “Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.” and both providers sit in that last group. Filing is their call; compliance is still yours: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.”
Sources
- Toast: PCI Compliance Overview (support center) (support.toasttab.com), read on 2026-10-24
- Toast: Use Toast in Offline Mode (support center) (support.toasttab.com), read on 2026-10-24
- Toast, Inc.: Form 10-K for fiscal year 2025 (filed 18 Feb 2026) (sec.gov), read on 2026-10-24
- Square: Payment security (squareup.com), read on 2026-10-24
- Square: PCI Compliance: Everything You Need to Know (squareup.com), read on 2026-10-24
- Square: Process card payments with offline mode (squareup.com), read on 2026-10-24
- Square: Restaurant POS (squareup.com), read on 2026-10-24
- Square: Handheld (squareup.com), read on 2026-10-24
- PCI SSC: Validated P2PE Solutions list (pcisecuritystandards.org), read on 2026-10-24
- PCI SSC: SAQ Instructions and Guidelines v4.0.1 r1 (April 2025) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC blog: Important updates for merchants validating to SAQ A (blog.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Assessment Guidance for Non-Listed Encryption Solutions v1.1 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
More processors and terminals: Payments & Card Data.