PCI Compliance for Raffle Sites

PCI DSS (Payment Card Industry Data Security Standard) is the ruleset for handling card data. Good news for Turbo IT operators: because we use Cashflows embedded checkout, your PCI scope is SAQ-A (the smallest, simplest tier). No card numbers ever touch your server.

Why SAQ-A applies to you

SAQ-A, the simplest of the nine SAQ levels, applies when:

• You never store, process, or transmit cardholder data on your own systems.
• The card data entry happens in an iframe / hosted page from a PCI-DSS-certified processor (Cashflows is Level 1 certified).
• Your site only redirects to / embeds the processor for the card data capture.

Turbo IT meets all three. The Cashflows iframe is what your customer types into; the data goes direct to Cashflows; we only receive a tokenised reference.

The annual SAQ-A questions

Roughly 20 questions covering:

• Confirming you don’t store/process/transmit card data yourself.
• Confirming your service provider (Cashflows) is PCI compliant: they publish an AoC (Attestation of Compliance) annually you can link.
• Confirming you have basic ops hygiene: change default passwords, patch your servers, use anti-malware, etc.
• Confirming you have written policies for customer data, incident response, and access control.

Most can be answered “Yes” truthfully on day one. The policy questions need you to actually have policy documents, and we ship templates as part of your T&Cs / Privacy Policy seeding.

When does PCI scope expand?

• If you ever take card details over the phone / email and type them into a back-office terminal yourself, you move to SAQ-C-VT or higher. Don’t.
• If you accept card-on-file or recurring charges where YOU store a token to re-charge later, the scope can grow. Our Cashflows integration stores the token at Cashflows’ side, not yours, so you stay at SAQ-A.
• If a customer ever sends you a card photo and you save it, you’ve broken scope. Delete immediately + retrain.

Annual scan

SAQ-A operators don’t need an external vulnerability scan (ASV scan): that’s for SAQ-D and above. Just the SAQ questionnaire and the AoC of your service provider.

If your acquirer asks for a quarterly scan anyway

Occasionally Cashflows or another acquirer adds “quarterly ASV scan required” to your merchant agreement, even though SAQ-A strictly doesn’t mandate one. They’re belt-and-braces; argue once, comply otherwise. Practical steps:

• Pick a PCI-approved scanning vendor. Trustwave, SecurityMetrics, and ControlScan are mainstream choices; £200–£500/year.
• They scan your domain quarterly. Expect false positives. The biggest false-positive sources for Turbo IT sites:
• Cloudflare TLS configuration flagged.Scanners test against the Cloudflare edge, not your origin. CF’s older cipher support sometimes gets flagged as “weak”, but it isn’t in practice. Reply to the scan report with the Cloudflare PCI compliance attestation and they’ll dismiss it.
• HTTP TRACE method enabled. CF does not actually permit TRACE; the scanner is misreading. Provide a curl test demonstrating TRACE returns 405.
• Subdomain enumeration.The scanner may list internal CF subdomains it found via DNS history; those aren’t in scope of YOUR PCI assessment. Submit them as out-of-scope with a one-line note.
• Keep the scan report email thread for your records. If Cashflows ever audits, you can show you ran the scan, addressed findings, and the auditor accepted the result.

For SAQ-D operators (rare for Turbo IT customers, that’s if you somehow store card data yourself), the quarterly scan is mandatory and the dismissal path is more formal. Talk to us before going down that route.