A VikingCloud alternative for ISOs, acquirers and PayFacs

Reviewing your merchant PCI program, or comparing VikingCloud before you sign? Here is a fair description of VikingCloud, the questions worth asking any vendor, how Compliance Assessment Tool works, and a practical plan for switching.

About VikingCloud

VikingCloud is the name Sysnet Global Solutions adopted in April 2022, bringing together businesses Sysnet had acquired: Viking Cloud and ControlScan in December 2020, and SecureTrust and NuArx in 2021. SecureTrust had been a division of Trustwave.

VikingCloud's programs for processors, acquirers and ISOs list merchant self-service PCI compliance reporting through its Asgard Platform, an auto-populated SAQ, ASV scans, endpoint protection, reporting dashboards, co-branded and white-label options, single sign-on, an API, web risk monitoring, and customer support in multiple languages. It also promotes a program called CCS Advantage.

Capabilities and terms vary by program, so confirm details with VikingCloud.

What to compare

The same questions apply to any merchant PCI program. The CAT column is what we do; the right-hand column is what to ask VikingCloud. We don't answer for them.

What to compare	Compliance Assessment Tool	Ask VikingCloud
SAQ selection	The merchant describes each way they take payments in their own words. AI picks the right SAQ for each payment method from all nine PCI DSS v4.0.1 merchant SAQs, asking a follow-up only when it needs one.	VikingCloud lists an auto-populated SAQ on its Asgard Platform. Ask what it is populated from, what the merchant confirms, and how merchants with more than one payment channel are handled.
Merchant experience	Every question is written in plain English for that business and that payment method, and each answer shapes the next. The merchant reviews and confirms every answer; nothing is auto-attested.	Can we see the exact questions a merchant with a countertop terminal answers? What share of invited merchants complete, and how long does it take them?
Branding and white-label	Your brand: a white-label portal and embeddable iframe, and branded invite emails.	VikingCloud lists co-branded and white-label options. Ask which one your contract includes, and whose brand appears on the emails and documents.
Integration options	Zero-code bulk invites, a platform redirect, an embeddable iframe, a REST API (OpenAPI 3.1) and an MCP server for AI agents. An optional Authorize.Net connection reads how a merchant takes payments.	VikingCloud lists an API and single sign-on. Ask for the API documentation and a test environment your engineers can use before you sign.
Portfolio reporting	Portfolio visibility for ISOs and banks: a portfolio API, CSV export for your sponsor bank, and signed webhooks.	What does the portfolio report show, can we export it in our sponsor bank's format, and can our systems receive status events?
Document output	The official PCI SSC SAQ and Attestation of Compliance, filled in and signed digitally by the merchant, as PDFs.	Is the output the official PCI SSC SAQ and AoC, signed by the merchant?
Pricing model	$25 per completed assessment. Free sandbox.	Is it priced per merchant, per month, per assessment, or bundled into a fee charged to merchants? Who pays, you or the merchant?
Bundled services	None: CAT does the SAQ and AoC. Pair it with an Approved Scanning Vendor if merchants need quarterly scans.	VikingCloud lists ASV scans, endpoint protection and web risk monitoring alongside PCI reporting. Ask which are included in your program, and whether you can drop the ones you don't need.
Switching and renewals	Bulk CSV invites move merchants over at their renewal dates. From then on, annual renewals carry the prior year's answers forward.	Can we export every merchant's status, SAQ type, AoC and validation dates as CSV? What do our contract's notice and data-return terms say?

The full list of criteria is in our guide to choosing a merchant PCI compliance program.

Where Compliance Assessment Tool fits

CAT is a PCI DSS compliance engine for ISOs, acquirers and PayFacs, under your brand. Each merchant describes how they take payments; AI picks the right SAQ for each payment method (all nine merchant SAQs under PCI DSS v4.0.1), and every question is written in plain English for that business and payment method, with each answer shaping the next. The merchant reviews and confirms every answer, signs digitally, and gets the official PCI SSC SAQ and AoC, filled in. You launch through a white-label portal, an embeddable iframe, the REST API or an MCP server, and see your whole portfolio through a portfolio API, CSV export and signed webhooks. Annual renewals carry prior answers forward. Pricing is $25 per completed assessment.

When CAT is not the better fit: If you want scanning, endpoint protection and web monitoring bundled with compliance under one contract, that is what VikingCloud's programs list and CAT does not do. You can also pair CAT with a scanning vendor.

Switching from VikingCloud

You don't have to move every merchant at once. Most of the work is lining up each merchant's move with its renewal date.

1. Read your current contract. Note the term, the notice period, the renewal date and what it says about returning your data.
2. Export your merchant list. For each merchant: merchant ID, legal and DBA name, contact email, payment channels, SAQ type, AoC date and validation expiry. A CSV is enough.
3. Keep existing AoCs valid until they expire. A merchant that validated last quarter does not need to start again. Keep its SAQ and AoC on file, and move it at its next annual renewal.
4. Re-validate at renewal. Invite merchants to CAT in renewal-date cohorts with a bulk CSV invite and branded emails, or build it into your portal with the iframe or API. Their next renewal on CAT carries this year's answers forward.
5. Board new merchants on CAT from day one, so the old program only has to cover merchants until their renewal.
6. Keep scanning covered. Merchants whose SAQ requires quarterly ASV scans still need them; keep your scanning vendor or choose one.
7. Tell your sponsor bank or acquirer, and agree how portfolio reporting will look during the overlap. CAT's CSV export and portfolio API cover the merchants it handles.
8. Update merchant communications and billing, including any program or non-compliance fee wording in your merchant agreement.

Common questions

Is VikingCloud the same company as Sysnet or ControlScan?

VikingCloud is the name Sysnet Global Solutions adopted in April 2022. Sysnet had acquired Viking Cloud and ControlScan in December 2020, and SecureTrust and NuArx in 2021; all of them now operate under the VikingCloud name.

Is VikingCloud the same as Trustwave?

No. SecureTrust, a PCI compliance business, was a division of Trustwave until Sysnet Global Solutions (now VikingCloud) acquired it in 2021. SecureTrust's own website now says its enterprise services have moved to VikingCloud and that SecureTrust serves small businesses only.

Is Compliance Assessment Tool affiliated with VikingCloud?

No. Compliance Assessment Tool is an independent company with no affiliation with, or endorsement from, VikingCloud. VikingCloud is a trademark of its owner.

Does CAT replace VikingCloud's scanning and security services?

No. VikingCloud's programs page lists ASV scans, endpoint protection and web risk monitoring alongside PCI compliance reporting. CAT covers SAQ selection, the plain-English assessment and the signed SAQ and AoC only. If you need those other services, keep or choose a provider for them and use CAT for the assessment.

Do merchants have to redo their SAQ when we change PCI vendors?

Not straight away. A merchant's current SAQ and Attestation of Compliance cover its current validation year, whichever tool produced them. The usual approach is to keep each AoC on file until it expires and move that merchant to the new program at its next annual renewal. Your acquirer sets the validation requirements, so confirm the plan with them.

Can we try Compliance Assessment Tool before we switch?

Yes. Sandbox credentials are free and issued as soon as you verify your email, and the sandbox runs the same API and engine as production. Run your own merchants' descriptions of how they take payments through it and compare the questions and documents side by side.

Also compared: SecurityMetrics alternative · ControlScan alternative · all PCI program alternatives

VikingCloud is a trademark of its owner. Compliance Assessment Tool is not affiliated with, endorsed by or sponsored by it, and names them only to describe their published offerings. Descriptions of other companies come from their own websites as of October 2026 and may have changed; confirm details with each vendor. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment. It is not a Qualified Security Assessor and does not certify compliance; acquirers set each merchant's validation requirements.