Plain-English answers about keeping cards on file
No legalese, no scare tactics — what the rules actually say, and what to do about them. Written by the team that runs a PCI DSS v4.0.1 attested vault.
How to stop storing credit cards in spreadsheets (and what PCI actually says)
The spreadsheet, the emailed PDF form, and the paper drawer — what PCI DSS v4.0.1 says about each, why password-protected workbooks don't count, and the workflow that replaces all three.
Read the guide → BILLING · 8 MIN READHow to set up recurring billing without storing credit cards
You never needed the CVV, and you don't need the number either. Stored-credential billing under the actual card-network rules — CIT/MIT in plain English, consent, expiry handling, and who should own the vault.
Read the guide → COMPLIANCE · 10 MIN READHow to reduce PCI scope for a small business (SAQ D to SAQ A, explained)
Your questionnaire is determined by your riskiest workflow, not your average one. What scope actually means, how one emailed card form drags the whole office into SAQ D, and the four moves that shrink it.
Read the guide → STORAGE · 5 MIN READCan you store CVV codes? No — here's why, and what to do instead
The brightest line in PCI: the security code may never be stored after authorization, in any form. The five places CVVs hide anyway, and why you never needed to keep them.
Read the guide → WORKFLOW · 7 MIN READLooking for a credit card authorization form? Here's what replaced it
The form documented consent; the card number just hitchhiked along — into inboxes and binders. The fully digital capture workflow that does both jobs without paper: request links, hosted and embedded fields, and the API.
Read the guide →