Services
Work with me
Hands-on PCI DSS help for small merchants and payment teams. Seventeen years of testing real payment systems — applied to your scope, your checkout, and your evidence.
Small and mid-size e-commerce businesses on a self-hosted checkout (WooCommerce, custom builds), SaaS products that take card payments, and payment teams that need someone who has actually tested the rails.
If you are on Shopify or Stripe Checkout with SAQ A and everything is genuinely outsourced, you probably do not need me — the free checklist is enough.
What I do
1. PCI scope & readiness review
The expensive mistakes in PCI are almost always scope mistakes. I map where card data actually flows, confirm which SAQ applies, and find the gaps before your acquirer or a QSA does.
- Scope and card-data flow mapping, in writing
- SAQ type confirmed, with the reasoning
- Gap list, prioritised by risk and effort
- A realistic cost picture, including what you can skip
From $600 · typically 1–2 weeks
2. Payment page security review (6.4.3 / 11.6.1)
Payment-page script attacks are the fastest-growing way card data gets stolen, and most small merchants have no idea whether their page is exposed. I review what actually loads and executes in a customer’s browser.
- Full inventory of scripts and third parties on the payment page
- Testing for unauthorised or tampered script loading
- Findings with evidence you can hand to your acquirer
- Remediation steps, ordered by impact
From $900 · typically 1–2 weeks
3. Payment QA & test automation
Payment flows break in ways that unit tests never catch. I build or audit test coverage for checkout, refunds, 3-D Secure, webhooks, and gateway failover.
- End-to-end suites (Playwright / TypeScript, API level)
- Regression coverage for payment-critical paths
- CI setup, so the tests actually run
- Audit of an existing suite that nobody trusts
$85 / hour · or a fixed scope after a call
How it works
- Scope call (30 minutes, free). You describe how you take payments and what is worrying you. I tell you honestly whether I can help.
- Fixed price, in writing. You get the deliverable, the timeline and the cost before anything starts. No open-ended engagements.
- You get the work, plus the reasoning. Every finding comes with why it matters and what to do about it — not just a checklist of red crosses.
How I handle your information
You are handing an outsider your payment setup. Here is exactly what that involves.
- What I collect
- Only what is needed to scope and deliver the work. I do not ask for card numbers, customer data, or production credentials. If a review needs access, we agree exactly what and why first.
- Where it lives
- Encrypted at rest, on accounts only I hold, with multi-factor authentication. Client material is kept separate from anything else, and never in a shared drive.
- Who sees it
- Me. No subcontractors, no offshore team, no “platform” that ingests your documents.
- What I will never do
- No reselling your information, no sharing with vendors, and no feeding your material into third-party AI models.
- How long I keep it
- Working material is deleted after delivery unless you ask me to retain it. Final reports are yours.
- NDA
- Happy to sign yours before anything is shared. If you would rather use mine, say so and I will send one.
Where I fit
A QSA — Qualified Security Assessor — is someone certified by the PCI Security Standards Council who can formally sign a Report on Compliance. Level 1 merchants are required to use one. Most businesses are not: they need their scope tightened, their SAQ answered correctly, and their gaps found early.
That preparation is exactly what makes a formal assessment shorter and cheaper if you ever need one — and if you do, I can get you ready for it.
I don’t sell software. No platform commissions, no reseller deals. If a tool isn’t worth it for your case, I’ll say so.
Background
Seventeen years in payment QA and payment security — payment gateways, cross-border acquiring, PCI DSS scoping, and payment page security. I have tested the systems that move the money, on both sides of the integration. More on the about page.
Start with a 30-minute scope call
Tell me how you take payments and what you are worried about. I will tell you honestly whether a review is worth it for your business.
Email me — pqa.labs@outlook.com
Not sure yet? Read Do I need PCI compliance? or take the free checklist first.Prices shown are starting points for small merchants and are confirmed in writing after a scope call. Availability is limited — I take a small number of engagements at a time.