PCI Compliance is a security standard that applies when you accept credit or debit cards
Payment Card Industry Data Security Standard (PCI DSS) is a set of rules created by the major credit card companies — Visa, Mastercard, American Express, Discover, and others — to protect customer payment information. If you accept cards as a homeowner (for rental income, a home-based business, or contractor work), you are responsible for meeting these standards or working with a payment processor that does.
The rules exist because card data breaches cost the industry billions annually. When you accept a card, you become responsible for that cardholder's information until it reaches a secure payment processor. PCI compliance is not optional — it is a contractual requirement of accepting cards, and violations can result in fines from your payment processor or card networks, even if no breach occurs.
Most homeowners and small operators do not handle this alone. You typically meet PCI requirements by using a PCI-compliant payment processor — a service like Square, PayPal, Stripe, or your bank's merchant services — rather than building your own secure system. Understanding what compliance means helps you choose the right processor and avoid common mistakes.
Key Takeaways
- PCI compliance is mandatory when you accept credit or debit cards, whether for rental income or a home business, and violations can result in fines from your processor.
- Most homeowners meet PCI requirements by using a certified payment processor like Square or Stripe rather than handling card data directly themselves.
- You are responsible for protecting cardholder data even if you use a processor, which means keeping your devices and software updated and never storing full card numbers.
- Your payment processor should provide documentation showing they are PCI-compliant; if they cannot, they are not a legitimate service.
- Compliance requirements vary based on how many cards you process annually, but even small operators must follow basic security practices.
How compliance levels work based on your transaction volume
PCI DSS defines four compliance levels based on how many card transactions you process in a year. The levels determine how much documentation and testing you must do, but the underlying security rules apply to everyone.
Level 1 applies to processors handling over 6 million card transactions annually — this is not relevant to most homeowners. Level 2 covers 1 million to 6 million transactions per year. Level 3 covers 20,000 to 1 million e-commerce transactions annually. Level 4 covers fewer than 20,000 e-commerce transactions per year or fewer than 1 million total transactions — this is where most small rental operations and home businesses fall.
Even at Level 4, you must follow security practices like keeping systems updated, using strong passwords, and never storing full card numbers. The difference is that Level 4 operators typically do not need to undergo annual third-party security audits, though your processor may still require you to complete a self-assessment questionnaire (SAQ) to confirm you are following the rules.
What you must do to stay compliant
Compliance means protecting cardholder data at every step. If you collect cards directly — through a payment terminal, online form, or phone call — you are responsible for that data until it reaches your processor's secure system.
The core requirements include: never storing the full card number after the transaction is complete; keeping all devices and software updated with the latest security patches; using strong, unique passwords for any accounts that handle payment data; encrypting card data when it is transmitted; and maintaining a firewall on any network where payment data flows. If you use a PCI-compliant processor and follow their instructions — which usually means using their payment form or terminal rather than building your own — you transfer most of this responsibility to them.
You should also have a written policy for handling card data. This does not need to be lengthy, but it should document who has access to payment information, how long you keep records, and what you do if a breach occurs. Many processors provide templates or guidance for this.
Choosing a processor that handles compliance for you
The easiest path for a homeowner is to use a PCI-certified payment processor that handles the technical compliance work. When you use their payment terminal, online checkout, or payment link, they manage encryption, secure storage, and compliance documentation. You are still responsible for following their instructions and protecting your login credentials, but you are not building a payment system from scratch.
Before signing up with any processor, ask them directly: "Are you PCI-compliant?" and request documentation proving it. Legitimate processors will have a compliance certificate or attestation they can show you. If they cannot provide one, do not use them — they are not meeting the standard, and you would be liable for any breach.
Common processors used by homeowners and small businesses include Square, PayPal, Stripe, and merchant services offered by your bank. Each has different fee structures, features, and compliance documentation. Compare what they offer, but prioritize working with an established, certified provider over a cheaper or newer service that cannot prove compliance.
What happens if you do not comply
Non-compliance can result in fines from your payment processor, the card networks, or both. Fines typically start at $100 to $500 per month for being out of compliance and can escalate if a breach occurs. If cardholder data is stolen because you failed to follow security practices, you may face much larger liability, including costs to notify affected cardholders, credit monitoring services, and potential lawsuits.
Beyond fines, your processor can terminate your account, making it difficult to accept cards in the future. Other processors may refuse to work with you if you have a history of compliance violations. For a home business or rental operation, losing the ability to accept cards can severely limit your income options.
The good news is that compliance is straightforward if you use a certified processor and follow basic security practices. Most homeowners never face a fine or breach because they are not handling raw card data — the processor is.
Common mistakes homeowners make with payment data
One frequent error is storing card numbers in email, text messages, or spreadsheets. Even if you think you are being careful, this creates a record of sensitive data that is not encrypted and is vulnerable to theft. Never write down or save a full card number. If you need to keep a record of a transaction, store only the last four digits and the transaction ID from your processor.
Another mistake is using an unsecured payment method, like asking a tenant to email their card number or texting it to you. This exposes the data in transit and violates PCI rules. Always use your processor's secure payment link, terminal, or form.
A third common issue is failing to update software and devices. If you use a payment terminal or computer to process cards, keep the operating system and all software current. Outdated systems are vulnerable to malware that can steal card data. Set automatic updates if your device supports it.
Documentation and record-keeping for compliance
You should keep records of your compliance efforts, especially if your processor asks you to complete a self-assessment questionnaire. This typically means documenting that you use a certified processor, that you follow their security guidelines, and that you have updated your systems. You do not need to keep every receipt, but you should be able to show that you are following the rules if asked.
Your processor will usually provide transaction records and receipts. Keep these for your accounting and tax purposes anyway. If a dispute arises or a cardholder claims they did not authorize a charge, you will need the transaction record to prove the payment was legitimate.
If you ever suspect a breach — for example, if a cardholder reports unauthorized charges or you notice suspicious activity — contact your processor immediately. They have procedures for investigating and notifying affected customers. Do not try to handle it alone.
Frequently Asked Questions
Do I need PCI compliance if I only accept checks or cash?
No. PCI compliance applies only when you accept credit or debit cards. If you collect rent or payments only by check, bank transfer, or cash, PCI rules do not apply to you. However, you should still protect any financial information you collect.
What if I use PayPal or Square — do I still need to worry about compliance?
PayPal and Square are PCI-certified processors, so they handle most compliance for you. You still need to follow their instructions — use their payment links or terminals rather than asking for card numbers directly — and protect your login credentials. But you do not need to obtain your own PCI certification or undergo audits.
Can I store a customer's card number for future payments?
Only if your processor allows it and provides a secure way to do so. Many processors offer "tokenization," which means they store an encrypted version of the card and give you a token (a code) to use for future charges. You never see or store the actual card number. Ask your processor if this option is available and how to use it safely.
What is the difference between PCI compliance and data breach insurance?
PCI compliance is a security standard that prevents breaches from happening. Data breach insurance covers costs if a breach does occur despite your efforts. Compliance is mandatory; insurance is optional but recommended as a backup. They work together but are not the same thing.
Do I need to tell my tenants or customers that I am PCI-compliant?
You do not need to advertise it, but it is a good sign of trustworthiness. If you are asking customers to pay online, mentioning that you use a secure, certified processor can build confidence. Your processor's website usually displays their compliance status.