About PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is maintained by the PCI Security Standards Council, an independent body created by the card networks in 2006. Any business that accepts credit card payments and transmits, processes and/or stores the related data must follow the PCI standard.
The PCI standard consists of 12 security requirements including encryption of cardholder data, managing firewalls, protecting systems against malware, and assigning unique IDs to each person with computer access.
PCI compliance levels are based on transaction volumes, with Level 1 being the most stringent requirement for the highest-volume processors.
Current Certification Status
PCI Booking Ltd, the company that operates the Orchestra Solutions service, maintains PCI DSS Level 1 Service Provider compliance – the highest certification level available.
Certification Details:
- Level: PCI DSS Level 1 Service Provider
- Version: PCI DSS v4.0.1
- Certificate: View PCI Compliance Certificate
Attestation of Compliance (AOC)
PCI Booking Ltd receives an annual Attestation of Compliance (AOC) from a Qualified Security Assessor (QSA). A new AOC is issued each year, typically in December.
Customer Compliance Documentation
How you validate PCI compliance depends on your role:
- Software platforms and other technology providers complete the Self Assessment Questionnaire D for Service Providers (SAQ D), recording most controls as outsourced to Orchestra. Orchestra provides the PCI documentation to evidence that.
- Merchants using Orchestra directly can complete SAQ A, because card capture and handling are outsourced to a PCI DSS compliant provider.
- Merchants on a platform that uses Orchestra can also complete SAQ A: they outsource card handling to the platform, which is compliant through its own SAQ D.
The Secure and Tokenize page sets out the same responsibilities in a table.
Sufficient documentation includes:
- Completed SAQ-D form
- PCI Booking Ltd’s AOC
Contact Information
For compliance documentation requests or questions:
- Contact: our team
- Additional resources: PCI Security Standards Council Documents Library