For small retail and e-commerce
Security work sized for a shop, not a security team.
Secure-Stack turns PCI DSS and the questions on your cyber insurance application into a short list of tasks a store owner can finish, with a plain-English guide for each one and a record of what you did.
- 14-day free trial
- No credit card
- Cancel anytime
From the PCI DSS SAQ A checklist
- Confirm payment processing is fully outsourced
- Use HTTPS for the entire customer journey
- Monitor for unauthorized changes to checkout pages
- Enforce strong passwords on all admin accounts
- Maintain a list of PCI-relevant service providers
Each task comes with a plain-English guide.
01Why it matters
What's already being asked of you.
01
Your processor asks for a PCI questionnaire
Most processors ask small merchants to complete a self-assessment questionnaire each year. Each SAQ A requirement is a task here, with the steps written out.
02
Your insurer asks how you're protected
Cyber insurance applications ask about MFA, backups and staff training. Work through the same controls ahead of time and keep the answers on file.
03
Customer data lives in a dozen apps
Orders, email lists and loyalty programs all hold personal information. The privacy framework maps what you collect and where it's stored.
02What's included
Frameworks that fit how you work.
These are the frameworks that matter most for you. Starter includes one of your choice; Pro and above include all of them.
31 tasks
PCI DSS SAQ A
For stores whose card payments are handled entirely by a provider, such as a hosted checkout page.
30 tasks
Cyber Insurance Readiness
The controls insurers ask about on applications and renewals: MFA, backups, email security, incident response.
40 tasks
Privacy · CCPA / GDPR
Data mapping, privacy notices, opt-outs and customer data requests.
85 tasks
CIS Controls v8
A widely used baseline for securing devices, accounts and networks.
03How it works
Three steps, at your own pace.
1
Answer a few questions
A short questionnaire at signup recommends the frameworks that apply to your business. Add or remove any of them later.
2
Work through the tasks
Each task says what to do and why, with a guide written for people without an IT background. Invite teammates or your IT provider to work through them with you.
3
Keep the evidence
Attach screenshots, documents and notes to each task as you finish it. When a processor, insurer, client or auditor asks, export it.
04Good to know
Questions we hear.
What Secure-Stack doesn't do
PCI DSS SAQ A applies when card processing is fully outsourced, as with a hosted checkout on an online store. If you run your own card terminals in store, your processor may require a different questionnaire, such as SAQ B or C, which Secure-Stack does not cover yet. The insurance, privacy and CIS frameworks apply either way.
- Does Secure-Stack make my store PCI compliant?
- It gives you every SAQ A requirement as a task with instructions, and keeps the evidence that you did it. You still complete and sign the questionnaire your processor asks for. Secure-Stack does not process payments or store card data.
- I only sell online through a hosted platform. Do I need this?
- Usually yes. A hosted checkout keeps card data off your systems, but SAQ A still has requirements for you, such as securing admin access, tracking your service providers and having an incident plan.
Start with the PCI DSS SAQ A checklist today.
From $50 a month, with a 14-day free trial and no credit card.