Does this file my SAQ?

No. It tells you which SAQ to download and what to re-confirm. You (or your QSA) complete the official form.

We use Direct Post — is that still SAQ A?

No. Merchant-served payment page elements → SAQ A-EP per PCI SSC's A vs A-EP table.

We're a service provider.

The only SAQ is D for Service Providers (if your brand allows SAQ at all).

Attended card-present with a validated PCI-listed SPoC solution only — not for unattended, MOTO, or e-commerce.

Is this legal advice?

No. Confirm with your acquirer and qualified counsel/QSA.

pci dss saq scope helper

Example session with this skill installed

We sell online. Stripe hosts the payment form in an iframe. We don't store card data. Which SAQ?

Read your context and instructions
Compiled the pci dss saq
Generated the data export

RESULT: SAQ A — Card-not-present, all account data functions fully outsourced.

Why: e-commerce with TPSP iframe/redirect/hosted payment page, no electronic storage, TPSP compliance confirmed.

Eligibility checklist (re-confirm from the official SAQ):

Only CNP transactions
All account-data processing outsourced to PCI DSS compliant TPSP
No electronic store/process/transmit on merchant systems
TPSP compliance confirmed
Paper retention only
All payment-page elements originate only from the TPSP
Site not susceptible to script attacks affecting e-commerce

Also: Direct Post / merchant-served payment scripts → SAQ A-EP (139 requirements per PCI SSC table).

Deliverables: saq.md, evidence.csv tracker, JSON. Download the official SAQ PDF from PCI SSC to complete it.

(Real run on bundled answers-ecommerce-iframe.json.)

evidence.csv

CSV · data export

Generated

Example file from a real run - the skill writes it into your workspace.

Connects securely to your tools. The creator never sees your data.

About this skill

Stop guessing whether you're SAQ A or A-EP.

Interview-driven helper that selects a PCI DSS v4.0.1 SAQ type using eligibility criteria from the official SAQ Instructions and Guidelines, v4.0.1 r1 (PCI SSC, April 2025). Covers A, A-EP, B, B-IP, C-VT, C, P2PE, SPoC, D for Merchants and D for Service Providers. Outputs the criteria checklist, requirement-family evidence tracker, and a clear "confirm with your acquirer" disclaimer.

Not a QSA assessment. Not legal advice.

What's included

SKILL.md, scripts/pci_saq.py, sample answer JSON files, references.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

pci dss saq scope helper