Completing your PCI questionnaire

Completing your PCI Self-Assessment Questionnaire (SAQ) is an important step in meeting industry security requirements for handling customer card data.

This guide provides step-by-step instructions on how to complete your SAQ directly within your Helcim account.

In this article

• How you'll know it's time to complete your SAQ

• Finding the PCI compliance section in your account

• Starting a new questionnaire or renewing your compliance

• Submitting your completed SAQ

• What to do if your business operations change

• Next steps

• FAQs

How you'll know it's time to complete your SAQ

You'll know it's time to complete or renew your PCI compliance when you see a notification in the account updates section on your Helcim account home page.

• For new Helcim merchants: You generally have 90 days from when your account is approved to complete your first SAQ.

• For annual renewals: PCI compliance is an ongoing, annual requirement. You’ll be able to access the renewal questionnaire once you are less than 90 days away from your current PCI compliance expiring. The notification in your account updates section will prompt you when this renewal period begins.

Finding the PCI compliance section in your account

This is where your PCI compliance journey with Helcim begins.

1. Log in to your Helcim account.

2. Click on All Tools.

3. Select My Business.

4. On the left-hand side menu, click on Security and Compliance.

On this page, you can learn more about PCI Compliance, see why it is important, and view your current compliance status (e.g. "Compliant," "Not Compliant," or when it's valid until).

Starting a new questionnaire or renewing your compliance

Depending on whether this is your first time or your annual renewal, and depending on which payment products you use, the steps are slightly different.

For new merchants

• Your status will likely show as "Not Compliant".

• Click the PCI DSS tile begin. Remember, you generally have 90 days from your account approval to do this the first time.

• If you see an option to ‘Answer a few questions’: Great! Select it, and continue following the steps in this guide.

• If you only see an option for a manual submission: This means your specific business setup requires a manual compliance process. Don't worry, we have a guide just for you! Please switch to: Manually submitting your PCI compliance.

For renewing your annual compliance

• You'll be able to renew once you are less than 90 days away from your current PCI compliance expiring.

• You should see a prompt to Renew Compliance on the Security and Compliance page. Click the PCI DSS tile to start the renewal process.

• If you see an option to ‘Answer a few questions’: Select it, and continue following the steps in this guide.

• If you only see an option for a manual submission: This means your specific business setup requires a manual compliance process. Don't worry, we have a guide just for you! Please switch to: Manually submitting your PCI compliance.

Understanding the questions: How Helcim tailors your SAQ

If you are now seeing Helcim's online questionnaire, here's what to understand about the questions presented:

• The questions you see are specifically generated based on how you use Helcim to process payments.

• Helcim automatically determines the Self-Assessment Questionnaire (SAQ) type(s) that apply to you based on the Helcim payment products you've recently used (like Online Checkout, the Helcim POS App, Virtual Terminal, etc.).

• The Helcim portal questionnaire supports several common SAQ types, including SAQ A, SAQ C, and SAQ C-VT.

• If you use multiple Helcim tools that fall under different SAQ requirements, our system cleverly combines the necessary questions into a single, streamlined questionnaire for you, and then will generate multiple SAQ reports for your records. This is much simpler than having to fill out multiple separate forms.

Tips for answering the questionnaire

Work through the questionnaire thoughtfully.

1. Read each question carefully. The questionnaire is a self-assessment of your business's security practices.

2. Answer all questions honestly based on your current operations.

3. If you need more clarity on a specific question, click the i (information) icon located on the right-hand side of that question for a more detailed explanation.

4. Optional: Towards the bottom of the questionnaire, you might see an optional section to list Third Party Vendors. This is relevant if you use external IT providers or other vendors who manage parts of your card processing environment on your behalf. You can add up to nine such vendors if applicable. If you don't use any, you can skip this.

Submitting your completed SAQ

Once you've answered all the questions:

1. Review your answers one last time.

2. Click the Submit Compliance button at the top of the page.

   • You should then see your new compliance status updated on the Security and Compliance page, along with the date it's valid until.

What to do if your business operations change

If how you accept credit cards or other significant parts of your business operations change during the year, your SAQ responses might no longer be accurate.

In this scenario, you may need to manually submit PCI compliance again before your renewal is triggered. Here’s how:

1. Return to the Security and Compliance page.

2. Click on the PCI DSS tile.

   • This will say ‘Complaint until X date’ if you’ve already done the SAQ before.

3. Manually submit or upload your compliance documentation

   • Upload files: Select the compliance file from your device.

   • Compliance type: Use the drop-down menu to select your SAQ type.

   • Your business name: This should be auto-populated with your business name.

   • Your name: This should be auto-populated with the owner’s name.

   • Your title: This should be auto-populated with the title entered in your account settings.

4. Once done, click Submit Compliance.

Next steps

• Once you've submitted your SAQ, your compliance status in your Helcim account will update. We'll cover more about what happens after submission, including your compliance documents, in this article: Accessing your PCI compliance report.

• Need to manually submit because of your business type? Visit this article: Manually submitting your PCI compliance.

• Remember that PCI compliance is an annual requirement, so you'll need to renew it each year.