1
Consult
We map how card data moves through your checkout, which providers and extensions touch it, and which SAQ applies.
A scope summary
Magento PCI compliance
Know which parts of PCI DSS apply to your Magento store, what's exposed on your payment page, and what to fix first, in a plan your assessor can work from.
Adobe Commerce gold partner
#1 Adobe Commerce partner worldwide
Hyvä Platinum Partner
40+ projects delivered
ISO certification
9001 & 27001
Most certified Hyvä agency worldwide
200+ Adobe Commerce Certifications
Award-winning agency
3× eCommerce excellence award
Magento PCI compliance, without the guesswork
We work out how card data moves through your store and which questionnaire that points to, then audit everything that touches payment.
The payment flow and checkout scripts
How card data is collected, and every script that runs where shoppers pay.
Extensions, admin access and patch level
What touches checkout, who can log in, and what's outstanding.
A report and a fix plan
Every gap ranked by risk and effort, mapped to the requirement it relates to.
We're not a QSA, and we don't issue certificates. The fix plan is what your assessor or acquirer works from.
Most PCI work on Magento is scope
The biggest decision is whether card data ever touches your servers. If it does, nearly every requirement applies. If it doesn't, the burden shrinks dramatically.
Card data kept off the serverMost modern integrations use fields or pages hosted by the provider, so Magento only receives a token.
Saved cards stored by the providerNot in your database, so stored cards don't bring the store into scope.
Checked, not assumedA legacy integration, a custom checkout step or an old extension can pull card data back in.
Which SAQ is your store on?
Merchants without a full on-site assessment report through a self-assessment questionnaire. Which one depends on how your checkout collects card data.
SAQ A
The payment provider handles all card entry, by redirect or embedded form. Shortest questionnaire, plus a script condition since March 2025.
Requirements in scopeFewestSAQ A-EP
Your store doesn't receive card data, but your own pages control how the payment form is delivered, so your site's security affects it.
Requirements in scopeMany moreSAQ D
Your store receives, processes or stores card data itself. Almost every PCI DSS requirement applies.
Requirements in scopeAlmost all
Your acquirer has the final say on which SAQ you file. The consult gives you the evidence to have that conversation.
Payment page scripts: where Magento stores are exposed
Card data is most often stolen by a malicious script on checkout, reading details as the shopper types. PCI DSS v4.0.1 addresses this directly.
Requirement 6.4.3
Every payment page script inventoried, authorised and checked for integrity.
Requirement 11.6.1
Unauthorised changes to the payment page and its security headers detected and alerted on.
Mandatory since 31 March 2025
For stores on SAQ A-EP and SAQ D.
Changed shape for SAQ A
Replaced in January 2025 by an eligibility criterion on script attacks. Meeting both still helps.
Magento Open Source, Adobe Commerce and Cloud: who covers what
No platform is compliant by itself. Compliance depends on how the store is built, hosted and run.
Both editions can be run within PCI requirements
Magento Open Source, formerly Community Edition, just as Adobe Commerce can.
Version 2.4.7 added payment page security
A restrict-mode Content Security Policy and Subresource Integrity on payment pages. Inline scripts may need tuning, and third-party scripts still need their own controls.
Adobe Commerce Cloud covers Adobe's infrastructure
Your extensions, code, checkout scripts, admin users and configuration stay with you.
How we work: consult, audit, fix plan
Three steps, each ending in something you can hand to your team or your assessor.
2
Audit
We test the payment flow, every payment page script, extensions, admin access, patch level, logging and the split with your host.
A written audit report
3
Fix plan
Every gap ranked by risk and effort, mapped to its PCI DSS requirement, with the Magento change that closes it.
A plan your team can run
What the audit checks
Every area tested against the requirements in scope for your store.
Payment flow
How card data is collected and travels, against the SAQ you file.
Payment page scripts
Every script's source, purpose and owner, and how changes are caught.
CSP and Subresource Integrity
Whether they're enforced on payment pages, and what they miss.
Extensions
Which touch checkout or customer data, and whether they're maintained.
Admin access
Accounts, roles, two-factor and leftover access for former staff.
Patch level
The Magento version, outstanding patches and supporting software.
Logging
What's recorded, where it's kept, and whether payment events trace.
Hosting responsibility
Which controls your host or Adobe covers, and which stay with you.
Doing the fixes
If you'd like us to make the changes, we can, through SOLVE or a dedicated team for larger programmes.
Tracked in the Magebit Client Portal
Every request visible, with its estimate and status.
Reviewed by a human developer
Every solution, before it reaches your store.
Patching kept current
Part of PCI evidence too, and run as its own service.
Working with your QSA or acquirer
Our work sits before the assessment. We don't sign off compliance.
Gaps found and fixed
Before the assessor arrives, not after.
Evidence documented
How the store meets each requirement in scope, written down.
Technical questions answered
If questions come back from the assessor, we answer the technical ones.
Why ambitious brands choose Magebit
Magebit brings Magento expertise to businesses in every country. From Perth, Melbourne and Sydney to London, Dubai, New York, Los Angeles, Charlotte and Florida, we’re ready to help wherever you are.
#1 Adobe Commerce partner worldwide
The top-ranked Adobe Commerce agency on the planet by Adobe themselves.
55+ Hyvä Certificates
The most certified Hyvä agency in the world. Confirmed by Hyvä themselves, twice.
Explore Hyvä development
Award-winning solutions
Innovator, World Traveler, and eCommerce Excellence awards across Meet Magento NYC and HIVE London, and more.
Hyvä Platinum Partner
The most-certified Hyvä agency worldwide and the first Hyvä Platinum Partner in the USA. 55+ Hyvä certifications and 40+ projects delivered.
ISO certified
ISO 9001 & 27001 for quality and security.
Scrum Alliance certified team
Truly agile team that moves and adapts faster than your typical agency.
Baymard certified design team
UX grounded in large-scale ecommerce research.
Start with how your checkout takes cards
Most stores we review are in a better PCI position than they feared, and the work is usually in the checkout scripts nobody listed. Show me how your store takes payments, and we'll map your scope before anything else.
Reviewed by Kristaps Rjabovs
Co-founder of Magebit, Forbes 30 Under 30
Frequently asked questions
If you can't find the answer you're looking for, feel free to reach out to us. We're here to help.
No platform is compliant on its own. Magento gives you the tools, including payment page security added in version 2.4.7, but compliance depends on your checkout, your extensions, your hosting and how the store is run.
It can be run within PCI requirements, just like Adobe Commerce. Most of the work depends on how your checkout collects card data and how the store is hosted and maintained, not on the edition.
No. Adobe covers the infrastructure it manages. Your code, extensions, payment page scripts, admin access and configuration remain your responsibility.
It depends on how card data is collected. If the payment provider handles all card entry through a redirect or embedded form, it's usually SAQ A; if your pages control the payment form, SAQ A-EP; if card data reaches your servers, SAQ D. Your acquirer confirms it.
They protect the payment page from malicious scripts. 6.4.3 requires every payment page script to be inventoried, authorised and integrity-checked, and 11.6.1 requires detecting unauthorised changes to the page. For SAQ A stores, they've been replaced by an eligibility criterion about script attacks, which meeting them still helps you satisfy.
No. We prepare the store and the evidence; a QSA or your acquirer assesses compliance.
Adobe Commerce (Magento 2) services
Explore the Magento services Magebit has to offer.
Book a PCI scope review
Tell us how your checkout takes payments and which SAQ you file today. We'll start with a consult to map your scope.
- 1
We map your scope
How card data moves through your checkout.
- 2
Your SAQ, with evidence
For the conversation with your acquirer.
- 3
A fix plan
Every gap ranked and mapped to its requirement.