How PCI Payment Gateways Work and Why They Matter for Your Business
What a PCI payment gateway does
A PCI payment gateway is the software and service that takes a customer's payment card information, encrypts it so it cannot be read in transit, and sends it to the bank or card network for approval. The "PCI" part means the gateway meets the Payment Card Industry Data Security Standard — a set of rules that protect card data from theft and fraud. When you swipe, tap, or type a card number into a checkout form, the gateway is what stands between that raw information and your business's own computer systems.
The gateway does not store the card number on your servers. Instead, it tokenizes the payment — converting the card details into a code that your business can use to process future transactions without ever touching the actual card number again. This separation is what keeps both you and your customer safer.
Key Takeaways
- A PCI gateway encrypts card data before it leaves the customer's browser or payment terminal, so your business never handles the raw card number.
- PCI compliance is required by card networks (Visa, Mastercard, American Express) and enforced through your payment processor or bank, not by a separate government agency.
- The cost of PCI compliance varies: some gateways include it in their monthly fee, while others charge per transaction or per month as a separate line item.
- If you do not use a PCI-compliant gateway and a card is stolen through your system, you face fraud liability, fines from card networks, and potential lawsuits from customers.
- Hosted payment pages and third-party checkout services (like Stripe or Square) handle PCI compliance for you; self-hosted checkout requires you to maintain your own PCI certification.
How the gateway encrypts and routes your customer's payment
When a customer enters their card number, the gateway uses encryption — a mathematical scrambling that only the bank can unscramble — to protect that information the moment it is typed. The encrypted data travels over the internet to the payment processor (often your bank or a company like Stripe, Square, or Authorize.Net), which forwards it to the card network (Visa, Mastercard, Discover, or American Express) and then to the customer's bank.
The customer's bank checks whether the card is valid, whether the account has enough funds, and whether the transaction matches the customer's normal spending patterns. It sends back an approval or decline code. The gateway receives that response and displays it to your checkout page — "Payment approved" or "Card declined" — in seconds. At no point in this chain does your business's own computer system ever see the unencrypted card number.
This routing is why the gateway is called a "gateway" — it is the passage through which payment data flows, and it controls what information is allowed through and in what form.
PCI compliance requirements and what they mean for you
The Payment Card Industry Data Security Standard (PCI DSS) is a set of 12 requirements created by Visa, Mastercard, American Express, Discover, and other card networks. They cover how you store data, who can access it, how you monitor your systems for breaches, and how you respond if something goes wrong. Compliance is not optional — card networks require it as a condition of accepting card payments.
The level of compliance you must meet depends on how many card transactions you process per year. If you process fewer than 20,000 transactions annually and use a hosted gateway (one where the customer enters their card on a page you do not host), you may only need to fill out a self-assessment questionnaire once a year. If you process more transactions or host your own checkout page, you may need an annual audit by a third-party assessor, which costs between $1,000 and $5,000 or more depending on your system's complexity.
If you do not maintain PCI compliance and a customer's card is stolen through your system, you can be fined by the card networks (often $5,000 to $100,000 or more per incident), held liable for fraudulent charges, and sued by affected customers. Your payment processor can also terminate your account.
Hosted gateways versus self-hosted checkout
A hosted payment page means the customer leaves your website and enters their card number on a page owned and secured by the payment processor. You never touch the card data. Examples include PayPal, Square, Stripe Checkout, and Authorize.Net Hosted Payment Page. With a hosted gateway, the processor handles PCI compliance for you, and you only need to meet a basic self-assessment questionnaire.
A self-hosted checkout means the customer enters their card number on a form that lives on your own website. You are responsible for maintaining PCI compliance on your own servers. This requires stronger security measures — firewalls, intrusion detection, regular security audits, encrypted databases, and staff training. Most small businesses avoid self-hosted checkout because the compliance burden is steep and the liability is high if something goes wrong.
If you use a self-hosted gateway, you must work with a PCI-certified payment processor and undergo annual audits. You also need to use an SSL certificate (the "https://" in your web address) and keep your software patched and updated. Many small business owners find that the cost and complexity of self-hosted checkout outweigh any benefit, and they choose a hosted solution instead.
What happens if your gateway is breached
If a customer's card is stolen through your payment system, the card network and the customer's bank will investigate. They will determine whether the breach happened because your gateway was not PCI-compliant, because you did not follow security practices, or because the processor itself was compromised. Liability falls on whoever failed to meet the standard.
If the breach was your fault — for example, you stored unencrypted card numbers on your server, or you did not update your software and a known vulnerability was exploited — you are liable for the cost of notifying customers, credit monitoring services, and any fraudulent charges. You may also face fines from the card networks and lawsuits from customers. If the breach was the processor's fault, the processor typically carries the liability and insurance.
This is why choosing a reputable, established payment processor matters. Larger processors like Stripe, Square, and Authorize.Net invest heavily in security and carry cyber liability insurance. Smaller or newer processors may not, and a breach could leave you exposed.
Costs and fees associated with PCI gateways
PCI gateway costs vary widely depending on the processor and the type of business you run. Some processors bundle PCI compliance into their standard monthly fee (often $10 to $50 per month). Others charge a separate PCI compliance fee, typically $10 to $30 per month. A few charge per transaction — usually $0.05 to $0.25 per transaction — or a percentage of sales.
If you need an annual PCI audit (because you process high volumes or use self-hosted checkout), you will pay an assessor $1,000 to $5,000 or more. Some processors offer audit services themselves; others require you to hire an independent assessor.
When comparing processors, ask for a full fee breakdown: monthly gateway fee, per-transaction fee, PCI compliance fee, and any audit or certification costs. The cheapest processor is not always the best choice if their security practices are weak or their support is poor.
Choosing a gateway that fits your business
If you are just starting out or processing fewer than 20,000 transactions per year, a hosted gateway like Stripe, Square, or PayPal is usually the simplest and safest choice. You avoid PCI compliance headaches, the processor handles security, and your setup takes hours rather than weeks. Monthly costs are typically $10 to $50 plus per-transaction fees of 2% to 3% of the sale.
If you process higher volumes or need custom integration with your own software, you may want a semi-hosted or self-hosted gateway. Processors like Authorize.Net and Worldpay offer both options. Self-hosted gives you more control but requires you to maintain PCI compliance yourself. Budget for annual audits and ongoing security maintenance if you go this route.
Before you sign up, ask the processor these questions: Do they provide PCI compliance documentation? What happens if there is a breach — who is liable? Do they offer tokenization so you do not have to store card numbers? What is their uptime may provide? Do they offer 24/7 support? The answers will tell you whether they are a good fit for your business.
Frequently Asked Questions
Do I need PCI compliance if I only accept payments through PayPal or Square?
No. PayPal and Square are hosted gateways, which means they handle PCI compliance for you. You only need to fill out a basic self-assessment questionnaire once a year. You do not need to maintain your own PCI certification or undergo audits.
What is tokenization and why does it matter?
Tokenization is when the gateway converts a card number into a unique code (a token) that your business can use to process future payments without ever storing the actual card number. If a hacker breaks into your database, they get tokens, not card numbers — tokens are useless without the gateway's encryption key. This is why tokenization is a core part of PCI compliance.
Can I use the same gateway for in-person and online payments?
Yes. Many processors like Square and Stripe offer both online gateways and physical card readers. They use the same PCI standards for both, so you do not need separate compliance for each channel. However, in-person payments (where the card is present) have different fraud rules than online payments (where the card is not present), so the processor may charge different rates.
What if my payment processor goes out of business?
Your customer data is usually transferred to another processor or held in escrow until you choose a new one. However, you should ask your processor what their data transition plan is before you sign up. Also, make sure your processor is FDIC-insured or carries cyber liability insurance so that customer funds are protected if something goes wrong.
Do I need a separate gateway if I sell internationally?
Not necessarily. Most major processors like Stripe and Authorize.Net support payments in multiple currencies and from multiple countries. However, international payments have higher fraud rates and different compliance rules in some countries, so you may pay higher fees. Ask your processor which countries they support and what the fees are before you expand internationally.