PCI DSS scope is decided by which systems card data flows through, not by transaction volume. This article unpacks the logic behind the four compliance levels, how to choose between SAQ A, SAQ A-EP, and SAQ D, the difference in compliance burden across four checkout architectures, and how tokenization and hosted checkout push scope to a minimum. It closes with a launch checklist you can work through line by line.
Choosing how to collect money on Shopify is not a rate question, it is an availability question. This guide covers the three collection paths, Shopify Payments availability limits, extra transaction fees on third-party providers, method coverage by market, multi-currency settlement, subscriptions, chargebacks, and switching costs.
Payment architecture is not a tooling preference. It is a one-time answer to who touches card data, who carries compliance, and who controls checkout. This article covers the payment structure only, separating the acquiring, gateway, and checkout layers and comparing self-built, SaaS, and hosted models.
Midtrans brings the three parallel rails of Indonesian payment structure into one acquiring setup: bank virtual accounts, e-wallets and the national QR standard each confirm differently, so card-only integration loses many local orders. This guide covers its position and boundaries, entity requirements, the hosted checkout versus core API trade-off, fee components and common misreadings.