Compliance Assessment ToolPCI DSS compliance API for ISOs, acquirers and PayFacs
Get your whole merchant portfolio through PCI DSS validation — under your brand. Merchants answer in plain English; you get the official, signed SAQ and Attestation of Compliance for every payment method, and a live view of who is compliant.
The merchant describes how they take payments; the platform picks the correct SAQ — all nine merchant types under PCI DSS v4.0.1 — and asks a follow-up only when it needs one.
One question per requirement, written for a restaurant owner, not an auditor. The merchant reviews and confirms every answer before signing.
The PCI SSC SAQ and AoC, filled in and signed, as PDFs your auditors and examiners recognise.
A portfolio API, CSV export, signed webhooks, and annual renewals that carry last year's answers forward.
What it looks like for a merchant
Owner: "Customers tap or insert their card on our machine at the register."
CAT: Does the card machine work on its own, or is it plugged into a register or computer?
Owner: It works on its own. It plugs into our internet router with its own cable.
CAT: Do you save any card numbers on your computers, register, phone system, or in email?
Owner: No, just paper receipts.
CAT: ✓ SAQ B-IP — a standalone card machine connected over the internet, nothing stored electronically.
The owner then completes that SAQ the same way — one plain-English question per requirement — reviews, and signs. You get the official SAQ and AoC PDFs and a signed merchant.compliant webhook.
| The owner says… | CAT confirms | SAQ |
|---|---|---|
| "We sell cakes on our website." | Customers pay on Squarespace's checkout page | SAQ A |
| "Customers call us and we take their card over the phone." | Staff type it into the payment company's web page on one dedicated computer | SAQ C-VT |
| "We have a card machine on the counter." | It dials out over a phone line | SAQ B |
| "We take cards on the terminals our processor gave us." | They're part of the processor's PCI-validated P2PE program | SAQ P2PE |
Five ways to launch
| Path | What it is | Lift |
|---|---|---|
| Bulk invite | Upload your merchant list; each merchant gets a branded email link to complete their SAQ. | Zero code |
| Platform redirect | Send merchants to a branded URL; they come back to your portal with a status and attempt ID. | One endpoint |
| Embedded iframe | Drop the white-label assessment into your merchant portal; the merchant never leaves your site. | Small |
| REST API | Build a fully custom experience or mobile flow. OpenAPI 3.1 spec. | Custom |
| MCP server | Let an AI agent or your bank's chatbot run the assessment conversationally. | Custom |
What the first calls look like
curl -X POST https://api.complianceassessmenttool.com/v1/merchants \
-H "X-API-Key: $CAT_API_KEY" -H "Content-Type: application/json" \
-d '{"name":"Corner Bakery","email":"owner@cornerbakery.example"}'
curl -X POST https://api.complianceassessmenttool.com/v1/merchants/$MERCHANT_ID/payment-methods \
-H "X-API-Key: $CAT_API_KEY" -H "Content-Type: application/json" \
-d '{"name":"Counter terminal","description":"Customers tap or insert their card on a countertop terminal that connects to our processor over the internet."}'
curl -X POST https://api.complianceassessmenttool.com/v1/merchants/$MERCHANT_ID/payment-methods/$PM_ID/determine \
-H "X-API-Key: $CAT_API_KEY" -H "Content-Type: application/json" \
-d '{"description":"Customers tap or insert their card on a countertop terminal that connects to our processor over the internet."}'
# → the SAQ for that payment method, or a plain-English question for the merchant (answer via /followup)
Full walkthrough in the integration guide · every endpoint in the API reference · or run the quickstart in Postman without writing code.
Integrate today — free sandbox
Same API, same engine as production. Credentials are issued as soon as you verify your email. $25 per completed assessment in production.
Get sandbox credentials →Comparing options? See how ISOs and PayFacs choose a merchant PCI compliance program.
Built for financial-institution due diligence
- No cardholder data, by design — descriptions of payment flows only.
- Human in the loop: nothing is auto-attested; the merchant reviews, confirms and signs.
- Answers grounded in PCI DSS v4.0.1 control text, with the reasoning kept for your compliance team.
- Trust Center, security overview and sub-processors published.
Common questions
Do merchants need to understand PCI DSS?
No. Merchants describe how they take payments in their own words; the platform determines the correct SAQ for each payment method and asks one plain-English question per requirement. They review and confirm every answer before signing.
What do we get at the end?
The official PCI SSC SAQ and Attestation of Compliance, filled in and signed by the merchant, as PDFs — plus signed webhooks and a portfolio API so your systems always know who is compliant, in progress, or expiring.
How do we integrate?
Five ways, from zero-code to fully custom: bulk CSV invite with branded emails, a platform redirect that returns the merchant to you with a status, an embeddable white-label iframe, the full REST API (OpenAPI 3.1), or an MCP server for AI agents and chatbots.
What does it cost?
$25 per completed merchant assessment. The sandbox is free and issued the same day.
Do you handle cardholder data?
No. The platform collects descriptions of how a merchant takes payments, never card numbers, CVVs or track data; the schemas have no fields for them.
Compliance Assessment Tool facilitates merchant PCI DSS self-assessment. It is not a Qualified Security Assessor and does not certify compliance; acquirers set each merchant's validation requirements.