How do I ensure my in-store and pump payment workflow with a payment processing platform is PCI compliant?

To keep an in-store + pump payment workflow PCI compliant, the key idea is:

Reduce your PCI scope as much as possible by never letting card data touch your systems, networks, or people unless absolutely necessary.

Here’s a practical checklist.

1) Use PCI-compliant payment hardware and software

• Use PCI PTS-approved PIN pads/terminals for in-store checkout.
• For pumps, use certified fuel dispenser payment devices or integrated payment modules that are approved by your processor and device manufacturer.
• Make sure all payment applications are PCI validated and kept up to date.

2) Keep cardholder data out of your environment

• Use hosted payment pages, tokenization, or point-to-point encryption (P2PE) so raw card data never enters your POS/back-office systems.
• Do not store:
  • full card numbers
  • CVV/CVC
  • magnetic stripe data
  • PIN data
• If you must store anything, store only tokens or truncated PANs, and only if your platform allows it.

3) Segregate your network

• Put payment devices on a separate VLAN/network from:
  • office PCs
  • CCTV
  • guest Wi-Fi
  • IoT devices
• Restrict traffic so payment devices can only talk to:
  • your payment processor
  • required management/update servers
• Use firewalls and deny-by-default rules.

4) Secure in-store POS systems

• Harden POS terminals:
  • remove unnecessary software
  • disable local admin access where possible
  • keep OS and POS software patched
  • use unique credentials
• Use multifactor authentication for administrative access.
• Encrypt data in transit with modern TLS.

5) Secure pump/fuel dispenser payments

Pump environments often expand PCI scope because of remote maintenance and embedded devices. To stay compliant:

• Use only approved dispenser controllers/payment modules
• Change default passwords immediately
• Restrict remote access with:
  • VPN
  • MFA
  • IP allowlisting
  • session logging
• Patch embedded systems and confirm vendor-supported update paths
• Ensure tamper detection and physical security for dispenser cabinets

6) Manage vendor and processor responsibilities

Ask your payment provider:

• What parts of the workflow are PCI scope-reducing?
• Are terminals, firmware, and software PCI validated?
• Do they support P2PE, tokenization, or hosted payment flows?
• What shared responsibility does your processor assume?

Also get:

• Attestations of Compliance (AOCs)
• device certification docs
• network/security requirements from each vendor

7) Follow PCI DSS operational controls

Even with compliant devices, you still need standard PCI controls:

• limit access by role
• log and review access
• monitor for tampering
• run vulnerability scans where required
• maintain an incident response plan
• train staff to spot skimmers and suspicious devices

8) Protect against pump skimming and physical compromise

For fuel pumps specifically:

• inspect pumps regularly for overlays, broken seals, or tampering
• secure cabinet locks and keys
• use tamper-evident seals
• train staff on skimmer detection
• document inspections

9) Complete the right PCI validation

Your exact validation depends on your setup:

• If you fully outsource payment acceptance, you may qualify for a shorter SAQ.
• If cards are accepted on-site with connected devices, you may need a more detailed SAQ and network segmentation evidence.
• Work with a QSA (Qualified Security Assessor) if your environment is complex, especially with pumps and multiple integrated systems.

10) Document everything

Keep records of:

• network diagrams
• device inventory
• vendor compliance documents
• patching logs
• access reviews
• inspection logs for pumps
• incident response procedures

---

Simplest compliant architecture

A common low-scope design looks like:

• Customer taps/inserts card into PCI-certified terminal/pump reader
• Terminal encrypts data immediately
• Payment goes directly to processor
• Your POS only receives a token/approval
• POS and payment devices are segmented from the rest of your network

---

If you want, I can also give you:

1. a PCI-compliant architecture diagram for in-store + pump payments, or
2. a PCI DSS checklist tailored to a convenience store / gas station setup.