PCI DSS 4.0.1: what a Shopify furniture store still owns

The old special-order form has a fabric code, a leg finish, and a full card number. On the back, someone has written the security code. Your online checkout may be carefully protected. The form in that drawer is a separate problem.

PCI DSS is the payment-card industry's security standard for businesses that handle card data. Using a hosted checkout reduces the payment information your store has to handle, but it doesn't protect information that staff copy elsewhere. Start with a simple store rule: card details belong in the approved payment process, never in the furniture order's notes.

General information, not legal advice. Confirm your payment-security and reporting obligations with your payment provider or acquirer.

What changed on March 31, 2025?

The 51 requirements given a future effective date in PCI DSS version 4 became effective on March 31, 2025. Version 4.0.1 was a limited revision, with clarifications and corrections rather than another set of added requirements. Which requirements your store must address depends on its payment environment; the headline number is not a list of 51 new tasks for every showroom. PCI Council's explanation; version 4.0.1 announcement.

There was also an important change to Self-Assessment Questionnaire A, or SAQ A. The January 2025 revision removed Requirements 6.4.3, 11.6.1, and the related 12.3.1 item from that questionnaire and added a criterion addressing susceptibility to script attacks. The revised form took effect on March 31, 2025. Those changes to the reporting form did not erase the underlying requirements from PCI DSS. PCI Council's SAQ A announcement.

SAQ A is a particular assessment route for certain outsourced payment arrangements. It is not a general certificate attached to the words “we use Shopify.” A store taking payments online, on the showroom floor, and by phone needs to describe all of those channels when establishing its assessment route.

Does the script rule apply to every hosted checkout?

The revised SAQ A script criterion specifically concerns a merchant page containing an embedded payment-provider form, such as an iframe. PCI Council FAQ 1588 distinguishes that arrangement from redirecting customers to a provider's payment page or sending a link to a fully outsourced payment page. The latter arrangements are outside this particular criterion. FAQ 1588.

For an embedded form, the Council describes two routes: protective techniques such as those in Requirements 6.4.3 and 11.6.1, or confirmation from the compliant payment provider that its properly implemented solution includes protection against script attacks. A generic assurance from an unrelated website app is not the same evidence.

Ask whoever maintains the website to draw the actual payment journey. Where does the customer enter the card? Which business supplies that page? Has anyone added a separate payment form, a custom deposit widget, or code that changes the journey? A diagram showing the real arrangement is more useful than a folder titled “PCI stuff.”

What does Shopify cover, and what stays with the store?

Shopify says it is certified Level 1 PCI DSS compliant and that its certification covers stores powered by its platform, their shopping carts, and web hosting. Its Help Center also explains how to obtain its annually reissued Attestation of Compliance; viewing that report requires a Shopify login. Shopify's PCI page; compliance reports.

That is valuable evidence about Shopify's service. It is not evidence about a carbon-copy form, an email inbox, or the shared password on the back-office computer. Keep those two subjects separate when discussing the store's responsibilities.

A provider's documents and the store's own procedures belong in the same operational review. Neither replaces the other.

Can we take a deposit over the phone?

A phone payment can be handled through a provider-approved process, but reading a card number to an associate changes who encounters the information. A back-office computer used for keyed payments is part of that process. So are call recordings, handwritten notes, and any screen-sharing or remote-support tools involved.

For a showroom, sending the customer a pay link is often the cleaner working habit. The associate confirms the order and amount; the customer enters payment information directly into checkout. Staff can stay on the phone to explain the deposit without asking the customer to read the card aloud.

Say a customer orders a $3,000 sofa with a $1,000 deposit. This example uses a payment request for the deposit, then a separate request for the remaining $2,000 when due. The order record needs those amounts and their payment status. It does not need the card number that funded either payment.

If the customer cannot use the link, the associate follows the store's approved alternative. “I'll write it down and run it later” should not be that alternative. Agree on the exception procedure before a busy Saturday, including what happens if the terminal or connection fails.

For the furniture workflow, see taking a special-order deposit and taking a deposit at the showroom register.

What should we do with old forms and emailed card details?

Stop creating new copies first. Remove card-number and security-code fields from order forms, stop requesting card details by email, and give trade clients a payment link instead. A long-standing account relationship is no reason to turn an inbox into a payment archive.

Then inventory the old material with access restricted to the people handling the cleanup. Paper, scanned attachments, order notes, email, and backups can hold different copies of the same information. Keep the furniture transaction evidence the business needs while arranging secure removal of card data through the store's retention and security process. Securely shred paper that no longer needs to be retained; a recycling bin is not secure disposal.

The card verification code deserves particular attention. PCI DSS prohibits keeping it after authorization, even encrypted and even with the customer's permission. It cannot be retained to make the future balance payment convenient. PCI Council FAQ 1280.

If the cleanup reveals suspected exposure or misuse, use the provider's incident process rather than treating it as routine filing. Avoid copying the affected data into another email to explain the problem. The fuller guide to card numbers on paper forms covers this drawer in more detail; customer-data privacy covers the wider records question.

Do we still need to submit an SAQ?

The organization accepting your compliance validation determines whether you must submit an SAQ and which one fits. PCI Council directs merchants to that organization, typically their acquirer or the payment brands. Shopify's hosting certification alone is not enough information to answer for every store. FAQ 1588.

Bring a complete channel list to that conversation: online checkout, showroom POS, phone payments, trade payments, and any separate processor. Include how refunds and balances are handled. Save the answer with the provider's evidence so the next person taking over the back office has the same instructions.

What should the showroom check now?

Use this ten-point self-check to find work to assign, rather than treating it as a substitute for an assessment:

1. Forms: Are card-number and security-code fields gone from paper and digital special-order forms?
2. Notes: Do staff record payment references and amounts without entering card details?
3. Email: Do trade clients and retail customers receive a payment link instead of a request for card information?
4. Phone orders: Is there one approved process, including an alternative when a customer cannot use the link?
5. Old records: Is there an owner for secure cleanup across paper, scans, inboxes, and other copies?
6. Access: Does each staff member have their own account and only the payment permissions their work requires?
7. Devices: Are payment devices protected, inspected through the provider's procedure, and handled by trained staff?
8. Website: Can someone explain whether payment redirects, embeds, or happens through another arrangement?
9. Evidence: Are the provider's compliance documents and the store's required validation steps easy to find?
10. Incidents: Does staff know whom to contact without circulating card details while reporting a concern?

Give each open item a person and a next action. The showroom already has enough objects with no obvious owner; the abandoned fabric ring can wait.

How does OrderPilot keep card entry out of the order?

OrderPilot sends deposit and balance payment requests that open Shopify checkout, and hands payment off to Shopify POS checkout at the register. Staff can see the payment on the order without putting card numbers in its notes. Payments taken another way can be recorded as offline payments, and roles control payment actions. The store still owns its payment procedures, but the everyday record can stay focused on the piece, the amount paid, and what is due. For the wider rulebook around the sale, keep the furniture delivery-law guide beside the payment procedure. Start the cleanup with the card-data drawer.

Sources

1. SAQ A changes, January 30, 2025 — PCI Security Standards Council.
2. FAQ 1588: SAQ A script eligibility — PCI Security Standards Council.
3. FAQ 1280: card verification codes, October 2023 — PCI Security Standards Council.
4. Future-dated requirements, August 20, 2024 — PCI Security Standards Council.
5. PCI DSS v4.0.1 announcement, June 11, 2024 — PCI Security Standards Council.
6. PCI-compliant hosting — Shopify.
7. Viewing Shopify's compliance reports — Shopify Help Center.