Do PCI Rules Still Matter When Customers Pay in Our Fuel App?
Yes. Taking a card payment in an app does not settle your company’s PCI duties. PCI DSS is the card-data security standard. Its audience includes merchants. Ask your acquirer, the firm that manages your card acceptance, to review the payment flow and tell you what proof it needs. Read the PCI Council’s guidance.
What is PCI DSS?
PCI DSS sets rules to protect payment account data. The PCI Security Standards Council lists firms that store, process or send card data as its audience. It also includes firms that can affect the security of that data. Merchants are on that list. Card brands, acquirers and other program owners decide what compliance and proof they require. See the Council’s scope.
What do we need to know about the payment flow?
Ask the provider to draw the path from the payment screen to the processor. Who gets full card details? What can your staff see? What goes into exports and support tools? Take those answers to your acquirer. Do not pick a self-assessment form from an app screenshot. First check the real flow.
What should the office avoid assuming?
Get the payment roles in writing. Name what the processor does, what the app provider does and what your office must do. A payment logo does not answer those questions. Keep the provider’s evidence with the role list. Assign someone to check it when the service or your office setup changes.
What should we check before launch?
Bring these questions to the people who manage your merchant account:
- Identify the merchant account and acquirer that will handle your app payments.
- Get a written description of the card-data path and every party involved.
- Ask what sensitive information staff, logs, exports and support tools can access.
- Have the acquirer confirm the validation process for the proposed setup.
- Name the person who will maintain access reviews, provider evidence and renewal tasks.
Questions owners ask
Does outsourcing payments remove all responsibility?
Do not assume it does. Ask the acquirer to review the exact service you plan to use. Write down the tasks your office still owns. Include who controls staff access and who keeps provider records. An outside processor should not leave a task with no named owner.
Can this page tell us which SAQ to complete?
No. The right self-assessment questionnaire, or SAQ, depends on the actual payment setup and what your acquirer requires. Bring the data-flow drawing to that review. Another dealer’s form may not fit your setup. Paying on a phone does not settle which form you should use.
Should customers send card numbers through order notes?
Use the approved payment screen for card details. Keep them out of order notes and routine messages. Ask the provider what staff should do if someone sends a card number anyway. Put that response in office training. Staff need a clear next step when a customer makes that mistake.
What evidence should we request from a provider?
Ask for current evidence that covers the exact service you will use. Have the acquirer tell you how it wants to review that evidence. Keep the response with the data-flow drawing. Check who will replace an old document when it expires or when the service changes.
What should we see in a payment demo?
Follow a payment in a provider-approved test setup. Look at what reaches the office. Ask about refunds, support access and exports. Do not guess which data those tools hide or reveal. Get those answers in writing and resolve them with the provider and acquirer before launch.
Primary sources
Bring your payment-flow questions to a Custom Fuel App demo. Related reading: Existing payment overview, Card surcharge questions. Find more on the answer hub.
Planning guidance for the office. Check the rules for your work with the agency, your lawyer or a qualified reviewer. A product setting does not prove compliance.
Last updated: 2026-10-17
Author: The Custom Fuel App team