PCI-DSS and a Lightweight Checkout: Staying Compliant Without Complexity in Nairobi (2026)

The verdict in three sentences

Storing or transmitting card data on your own server drops you into the SAQ-D questionnaire and its 300+ controls: costly, slow and risky. By delegating card entry to a hosted checkout (redirect or iframe/tokenization), you cut your scope to SAQ-A (about twenty controls) and avoid an audit cost of 2 to 8 million FCFA. Bonus: mobile money (M-Pesa, MoMo) is outside PCI scope, which simplifies the picture further.

PCI-DSS, explained simply

PCI-DSS is the card-data security standard. Its logic is blunt but sound: the less your system touches the card number (the PAN), the fewer your obligations. A card form served and processed by your server = maximum scope. A card field served by the provider (iframe) or a redirect to their page = minimum scope, because the PAN never passes through you.

Self-hosted form vs redirect/iframe

The technical choice determines your entire compliance effort. A self-hosted form gives you total visual control but imposes the heavy audit. Redirect or iframe delegates the sensitive part and brings you back to a short checklist, with tokenization (the provider returns a token instead of the number) letting you handle subscriptions and refunds without ever touching the PAN.

In plain terms: barring a very specific need, no small business should host card data. Redirect or a tokenized iframe covers 99 % of cases, and mobile money, a priority in Kenya, doesn't even enter the PCI calculation.

Mini case study

Fatou launches a ready-to-wear store in Nairobi. A vendor pitches a self-hosted card checkout 'for the customization'. Estimated SAQ-D audit cost: between 2 and 8 million FCFA, plus several months to comply. Switching to a tokenized iframe checkout + M-Pesa/MoMo, she moves to SAQ-A: compliant in 1 to 2 weeks, 0 FCFA of heavy audit, and no card number stored. Direct saving: at least 2,000,000 FCFA avoided, not counting the legal risk of a breach she will never carry.

FAQ

Does PCI-DSS really apply to me as a small store? Yes, as soon as you accept cards. But with a hosted checkout, your obligations reduce to SAQ-A (about twenty points), which is entirely manageable.

What is the concrete difference between SAQ-A and SAQ-D? SAQ-A is for merchants who never touch the card number (~20 controls). SAQ-D has 300+ and often involves a costly external audit, 2 to 8 million FCFA depending on context.

Does tokenization let me handle subscriptions? Yes. The provider returns a reusable token instead of the number, enabling recurring charges and refunds without ever storing the PAN on your side.

Is mobile money inside PCI scope? No. M-Pesa and MoMo don't handle card data in the PCI sense: they are out of scope, which further simplifies your compliance in Kenya.

Can I earn a commission by referring Kolonell? Yes. Our referral program pays 15 % + 5 % recurring on a showcase site, 12 % on e-commerce, 10 % on a marketplace, 8 % on an institutional project. Introduce a client, we handle the rest.

Let's talk about your project. We build a lightweight, SAQ-A-compliant checkout with tokenization and mobile money integrated. WhatsApp +221 77 596 93 33.