Every business that accepts card payments must complete a PCI DSS Self-Assessment Questionnaire once a year. The questions are set by the PCI Security Standards Council and must be answered exactly as written. What had not been addressed, according to Paytia, was where those questions are supposed to be completed: at a desk, on a laptop, while the items being reviewed are in another room.

“The questions are the questions — reword them and you haven’t filled one in. We put the questionnaire on the phone, let the camera do the filing, and kept the photos on the device where they belong.” — Curtis Nash, CEO, Paytia

Paytia Comply moves the questionnaire to the phone in your pocket. It covers all nine SAQ types and 966 PCI DSS v4.0.1 requirements, one at a time, so users can respond where the evidence actually is.

Users can select the questionnaire that matches their payment setup — A, A-EP, B, B-IP, C, C-VT, D for Merchants, D for Service Providers or P2PE — or tap “Help me choose” and answer a few questions about their environment. Each SAQ explains what it covers and how many requirements it includes, ranging from 28 for SAQ B to 145 for A-EP. Users then work through the questions, marking each one Yes, No or N/A, while progress is tracked throughout.

The question stays the question

When a requirement is opened, the official PCI SSC wording appears under a heading that says, plainly, “The question.” Paytia says the wording has not been paraphrased or shortened. The company states that a reworded SAQ would no longer be an SAQ.

What Comply adds is the surrounding guidance: what each requirement means and what evidence may be needed to satisfy it, including the documentation to review, the personnel to interview and the configuration settings to check. The standard’s language remains intact, while the explanation sits beside it, giving users context without changing the source text they are being asked to answer.

The camera does the filing

Many requirements call for proof rather than a simple checkbox, such as evidence of a server room lock, terminal setup or visitor log. Paytia says collecting that evidence has often been cumbersome: taking a photo, emailing it to yourself, downloading it on a laptop, renaming the file and then identifying which requirement it belongs to.

Comply is designed to remove that extra work. Users standing in front of the item being reviewed can tap “Take photo” and attach the image to the relevant requirement. The photos remain on the device. When the questionnaire is finished, the material is compiled into a PDF that can be exported or emailed to an acquirer or a QSA. In practice, that means the app is aimed at the point where evidence is gathered, not the point where it is later reviewed.

A pocket reference for the browser, too

Not every PCI question comes up in a server room. Many arise at a desk, often as a question about which SAQ applies or as an acronym in an acquirer’s email. For those situations, Paytia also offers a free Chrome extension, PCI SAQ Pocket Reference: chromewebstore.google.com/detail/pci-saq-pocket-reference/amkphflaeaegcigdnjdffclpmamjifcf.

The extension sits in the browser toolbar and provides three functions: an eight-question decision guide that helps users identify the correct SAQ, a plain-English glossary of 15 PCI terms — including PAN, CDE, AOC and P2PE — and links to Paytia’s free checklists for SAQ A, A-EP, B and D. Paytia says it works offline, asks for no permissions, includes no tracking and is open source under an MIT licence.

The extension addresses questions that arise at a desk, while the app is used to complete the questionnaire itself, standing in front of the evidence. Paytia also provides a free instant checker at paytia.com/resources/tools/which-saq, which uses eight questions in the browser and does not collect information.

Why Paytia built it

Paytia says it has been a PCI DSS Level 1 certified provider since 2016, helping contact centres and customer-not-present merchants remain compliant. The company says it kept seeing the same pattern: businesses knew the annual SAQ was due, downloaded the official PDFs, opened them on a laptop and then stopped because the document was written for the assessor who would eventually review it and because much of the required evidence was elsewhere in the building.

According to Paytia, the issue was not the questions themselves but where they were being answered. That distinction matters because PCI self-assessment is still a formal process, and the practical friction often comes from organizing evidence and choosing the right questionnaire before a review can even begin.

What it does not do

Paytia describes Comply as a checklist and evidence-capture tool. It is not legal or compliance advice, and the acquirer has the final say. It does not certify a business as PCI compliant; that requires an attestation from a QSA, or for SAQ-eligible merchants, a self-attestation signed by the business. It also does not run external scans or penetration tests, and it does not implement the technical controls required by the standard.

What it does, Paytia says, is move the questionnaire off the laptop and put it where the evidence is.

“An SAQ isn’t something you’re allowed to simplify. The questions are the questions — reword them and you haven’t filled one in. What nobody had asked is where you’re supposed to be standing when you answer them. It’s never at a desk. It’s in the room with the card terminal, or the cabinet, or the visitor log. So we put the questionnaire on the phone, let the camera do the filing, and kept the photos on the device where they belong.” — Curtis Nash, CEO, Paytia

Paytia also points readers to its free Chrome extension and instant checker, and notes that the company’s broader PCI-focused tools are intended to help users determine the correct SAQ and organize evidence for review.