Do we need to do any PCI compliancy if I use Square or is it inbuilt

[eellc15]

We run a small business and don't have a dedicated IT manager. I'm wondering if going with Square if we will have to go through all of the compliance work ourselves or is it just built into the system and we can be ready to go with just the main system setup

[Donnie-M · Accepted solution]

@eellc15 Good news, Square is fully PCI compliant and you do not have to do anything.  With the EMV shift, you will need to use the contactless chip reader in order to be fully protected for in person transactions.  Basically if you swipe a chip card you are accepting any liability for fraud on an in person transaction.

So no, that is one of the things covered by your swipe fees is the PCI compliance.  I have seen this brought up by pushy sales people that try to sell you on their processing versus square...

Here is the link for more information:

https://squareup.com/us/en/security 

"As the merchant of record, Square takes on the burden of PCI compliance for our sellers."

[aehyphen]

What about when Square is storing a customer's credit card for a subscription to a plan? If the customer subscribes with the plan link and they input all the credit card info themselves and I never see the card, do we need to do anything related to PCI compliance in these cases?

[JJ_]

No, you only have access to the last four digits of the card which is not a PCI compliance risk on your end.