Insights
Taking credit cards on your website, and what it asks of you
The moment your site takes a credit card, you've made a promise to guard it. PCI is the card industry holding you to that promise, and how heavy it gets depends almost entirely on one architectural choice.
Where the card data actually flows
Follow the number. On some stores, the customer types their card into a checkout the platform hosts, and the number never touches your site at all. On others, the card form lives on your own pages and the number passes through your server on its way to the processor.
That one difference decides most of your obligations. Keep the number off your site and the heavy compliance burden sits with the platform, which handles it professionally at a scale no small business can match. Let the number touch your infrastructure and the burden is yours, the server, the code, the certificates, the logging, all of it now in scope.
What the platforms carry for you
This is a real argument for hosted checkouts. A Shopify style checkout or a hosted payment page from your processor keeps card entry inside their walls, and their compliance work becomes your shelter. Your self assessment stays short because your exposure stays small.
A self hosted store can be built to the same effect, the trick is wiring the payment form so the number goes straight from the customer's browser to the processor without resting anywhere you control. Done right, you keep ownership of your store and still stay out of the deep end. Done casually, you've quietly signed up for the full obligation and nobody told you.
What stays yours no matter what
No architecture removes all of it. Never store card numbers, not in the database, not in an email, not in the order notes where a helpful employee pasted one over the phone. Keep the software current, because an out of date store is how numbers get skimmed. Use strong logins and limit who can see orders. And know that the self assessment questionnaire is an annual ritual, short or long, that your processor expects you to take seriously.
The phone order is the classic leak. A card read aloud and written on a sticky note has left compliance entirely, and it happens in friendly businesses every day.
The cost of casual
A breach on a non compliant store means the processor and the card brands come looking, and the fines land on the merchant, not the platform. The bigger bill is the same one it always is, customers who trusted you with a card and found out you were casual about it.
None of this requires fear, it requires an architecture chosen on purpose. That's a build decision, and it's cheap on day one.