PCI Compliance for Salons: A Plain-English Guide

What PCI DSS Actually Is

PCI DSS stands for Payment Card Industry Data Security Standard. It's a set of security requirements created by the major card networks — Visa, Mastercard, American Express, Discover, and JCB — to protect cardholder data. It's not a law, but it functions like one: your merchant agreement with your payment processor requires compliance, and failing an audit or experiencing a data breach while non-compliant can result in fines from $5,000 to $100,000 per month, plus liability for fraudulent charges.

The good news for most salons: if you're using a modern payment processor with certified hardware, most of the heavy lifting is done for you. The bad news: there's still a self-assessment questionnaire (SAQ) you need to complete annually, and some operational practices you need to maintain.

What PCI Level Are You?

Merchants are sorted into four levels based on annual transaction volume:

• Level 1: Over 6 million Visa/Mastercard transactions per year. Requires an on-site audit by a Qualified Security Assessor (QSA). This is not you.
• Level 2: 1–6 million transactions/year. Annual SAQ plus quarterly network scans. Also unlikely to be you.
• Level 3: 20,000–1 million e-commerce transactions/year. Mostly relevant if you have significant online booking with card storage.
• Level 4: Fewer than 20,000 e-commerce transactions or up to 1 million total transactions. This is most salons. Annual SAQ, possibly quarterly scans depending on your processor's requirements.

As a Level 4 merchant, your primary obligation is completing the right SAQ type for your payment setup, typically annually, and submitting it to your processor. Many processors include this in their portal.

SAQ Types and Which One Applies to You

There are several SAQ variants. The one you fill out depends on how you accept payments:

• SAQ A: Card-not-present merchants who have outsourced all cardholder data functions to PCI-compliant third parties. If you use a hosted checkout page for online booking (hosted processor checkout, etc.) and don't store any card data yourself, this is often your path. It's the simplest — roughly 22 questions.
• SAQ B: Merchants using standalone dial-up or IP-connected terminals that don't store cardholder data. If you have a physical terminal like a PAX A920 or A80 connected through a certified gateway, this often applies to card-present operations.
• SAQ B-IP: Similar to SAQ B but for IP-connected terminals with more network complexity.
• SAQ P2PE: Merchants using a PCI-validated Point-to-Point Encryption (P2PE) solution. If your processor offers certified P2PE (NMI + PAX combination supports this), this SAQ is significantly shorter because the encryption happens in certified hardware before data ever touches your network.

Most salons running modern cloud-based payment software with certified terminals end up on SAQ A or SAQ B-IP. Ask your processor which one they expect from you — this is not something to guess at.

Cardholder Data: What You Should Never Store

The first rule of PCI compliance is don't store cardholder data unless you absolutely have to, and if you do, protect it with everything the standard requires. For most salons, there's no reason to ever see a full card number. Modern processors tokenize card data — what your system stores is a meaningless string (a token) that the processor can map back to the underlying card. The token alone is useless to a thief.

What you must never store under any circumstances:

• Full magnetic stripe data (track data)
• CVV2/CVC2 security codes — even temporarily, even in logs
• PINs or PIN blocks

If your point-of-sale software logs card numbers anywhere — in debug logs, audit trails, exports — that's a compliance failure. Check with your software vendor. Reputable ones certify their software under PA-DSS (now SSVS) and can confirm they don't log sensitive authentication data.

Network Segmentation for Salons

If your payment terminals share the same Wi-Fi network as your client-facing equipment, or worse, the same network your staff uses for personal browsing, that's a scope expansion problem. PCI scope means everything connected to your payment environment is potentially in scope for compliance. The easiest solution is network segmentation: put your payment terminals on a separate VLAN or dedicated Wi-Fi network that doesn't touch anything else.

Most consumer-grade routers support VLANs. A managed switch costs $80–150. For a salon, this is a one-time setup that dramatically narrows your PCI scope and reduces your SAQ complexity. Have a network person do it correctly once and document what they did.

Physical Security

PCI also covers physical security. Your terminals should be:

• Inspected regularly for skimming devices — small overlays criminals attach to card readers. Know what your terminal looks like when it's clean.
• Secured when unattended — don't leave a PAX A920 sitting on a counter overnight unlocked.
• Logged — know which terminals you have, their serial numbers, and who is authorized to access them.

Skimming is not hypothetical. Salons in high-foot-traffic areas are targets. A quick visual and tactile inspection of the card reader each morning takes 10 seconds.

Booth-Rent Salons: Who's Responsible?

In a booth-rent setup where each stylist has their own merchant account, PCI compliance responsibility falls primarily on each stylist as the merchant of record. The salon owner's exposure is reduced, but not eliminated — you still control the physical space, the network, and any shared equipment.

Practically: if a renter is using their own account with a processor-provided reader, the processor handles the compliance infrastructure and the renter's SAQ is minimal. If you're running a shared PAX terminal with multiple merchant credentials routed through an application, the security of that terminal and the network it sits on is your responsibility.

The Short Checklist

• Confirm with your processor which SAQ type you're required to complete.
• Complete it annually and keep a copy.
• Use only PCI-certified terminals and software.
• Segment your payment network from general-use Wi-Fi.
• Never store sensitive authentication data (CVVs, full track data).
• Inspect terminals physically, regularly.
• Train staff to not write card numbers down, ever.
• If you experience a breach or a terminal compromise, notify your processor immediately — delays make the fines worse.