How do I ensure my campaign donation checkout with an online donation platform is PCI compliant?

To make a campaign donation checkout PCI compliant, the safest path is to avoid handling card data yourself and use a PCI-compliant donation platform/payment processor that keeps card numbers out of your systems.

What to do

1. Use a hosted or embedded payment form from a compliant provider

Choose a donation platform that:

• is PCI DSS compliant
• uses tokenization
• supports hosted payment pages or secure embedded fields
• provides a current Attestation of Compliance (AOC) or equivalent documentation

Best option: a hosted checkout where donors enter card data on the provider’s secure page.

2. Don’t store or transmit card data on your website

Your site should never:

• capture card numbers directly in custom HTML forms
• log card data in analytics, server logs, or error reports
• send card details through your own backend unless you are prepared for much stricter PCI requirements

If you use an iframe, hosted fields, or redirect flow, ensure the card number never touches your servers.

3. Keep your integration scope small

PCI obligations depend on how much your environment touches payment data. To minimize scope:

• use the platform’s prebuilt donation page
• avoid custom code that handles card data
• use tokens for recurring donations instead of storing payment details
• separate donation flows from your main website where practical

4. Complete the right PCI questionnaire

Depending on your setup, you may need:

• SAQ A: typically for fully hosted checkout with no card data touching your site
• SAQ A-EP: if your site can affect the security of the payment page, even if card data goes directly to the processor
• more extensive validation if you directly handle card data

Ask the platform and your payment processor which SAQ applies to your exact integration.

5. Secure the rest of your site

Even if payment data is outsourced, you still need basic security controls:

• HTTPS everywhere
• strong admin passwords and MFA
• regular plugin/software updates
• restricted access to donor data
• vulnerability scanning and monitoring
• Content Security Policy if you embed third-party payment elements

6. Review donor data handling

PCI is about card data, but privacy and security also matter for donor records:

• minimize collection of sensitive personal data
• encrypt donor data at rest
• limit who can access donor info
• define retention and deletion policies

7. Get documentation from your vendor

Ask the donation platform for:

• current PCI DSS AOC
• their responsibility matrix
• whether they are a service provider under PCI
• whether their integration keeps you in SAQ A or pushes you into SAQ A-EP

Quick checklist

You’re usually in good shape if:

• donor card details are entered only on the provider’s hosted page
• your site never receives raw card data
• you use tokenized recurring payments
• the provider gives you PCI compliance documentation
• you complete the proper SAQ for your setup

Important note

PCI compliance is not just a technical setting—it depends on the exact flow of data. A simple iframe, redirect, or custom API integration can change your compliance scope.

If you want, I can help you determine which PCI SAQ likely applies to your donation setup if you describe how your checkout works.