PCI DSS Level 1 Hotel Software: Reduce Your PCI Scope

Written by: Kelly Campbell, Vice President of Marketing, Stayntouch

Key Takeaways

• PCI DSS Level 1 hotel software is a PMS or payment solution that has passed the strictest annual on-site audit by a Qualified Security Assessor and handles more than 300,000 transactions per year as a service provider.

• When the software uses point-to-point encryption and tokenization, raw cardholder data never enters the hotel’s systems, which shrinks the property’s PCI scope and audit workload.

• Using a PCI DSS Level 1-certified payment service provider lets a hotel focus its PCI assessment on only the systems that interact with the provider’s compliant infrastructure.

• Hotels that route card capture through a certified PCI DSS Level 1 PMS or payment gateway can often qualify for a simpler Self-Assessment Questionnaire instead of a full Report on Compliance.

• Learn how Stayntouch Pay can help reduce your hotel’s PCI compliance scope, and contact us to get started.

How PCI DSS Level 1 Works for Hotel Payments

PCI DSS is the card industry’s security standard, maintained by the PCI Security Standards Council. It applies to any entity that stores, processes, or transmits cardholder data. The standard divides participants into merchants and service providers, and each group faces different volume thresholds that determine which compliance level applies.

For service providers, which are companies that process payments on behalf of merchants, Level 1 applies to those handling more than 300,000 transactions annually. For merchants, the Level 1 threshold is more than 6 million transactions per year across a single card brand. A hotel PMS vendor or payment processor that crosses the service-provider threshold must complete an annual on-site assessment by a QSA, which results in a formal Report on Compliance (ROC) submitted to the acquirer, the bank that receives card payments on the hotel’s behalf.

Level 1 entities also undergo quarterly network vulnerability scans by an Approved Scanning Vendor (ASV), maintain an incident response plan, and demonstrate continuous compliance with all 12 PCI DSS requirements. A certified provider publishes an Attestation of Compliance (AOC), which is a formal document hotels can reference to confirm the provider’s status.

This structure matters for hotel operators because partnering with a certified provider shrinks the hotel’s compliance footprint to just the touchpoints between its systems and the provider’s secure infrastructure. This architectural approach can qualify the hotel for an SAQ, a shorter compliance form, instead of the full ROC required when card data flows through hotel-owned systems. The SAQ is the document a hotel completes to validate its own compliance posture, and the type of SAQ required depends directly on how card data moves through the property’s systems.

PCI DSS v4.0.1 is now the sole active version of the standard, with all future-dated requirements from v4.0 mandatory as of March 31, 2025. The standard now treats compliance as a year-round discipline rather than an annual event. Architectural scope reduction, which keeps card data out of hotel systems entirely, has become more critical than ever.

Managing PCI Compliance In-House at a Hotel

A hotel can manage PCI DSS compliance without a Level 1-certified service provider, but the scope, cost, and operational burden are substantial.

PCI DSS scope includes all systems that store, process, or transmit cardholder data, plus any connected systems that could impact the security of the Cardholder Data Environment (CDE), including identity systems, logging platforms, backup systems, administrator workstations, and shared networks. In a hotel, that can include the PMS, point-of-sale (POS) terminals in the restaurant and bar, spa booking platforms, parking kiosks, and any network segment those systems share.

The five most common PCI failures in hotels are shared credentials, flat networks without segmentation, legacy POS systems on unsupported operating systems, vendor remote access lacking unique credentials or multi-factor authentication (MFA), and unsecured public network overlap with business systems. Each failure extends the scope of remediation and lengthens the timeline to compliance.

A first-time PCI DSS v4.0.1 assessment can take several months from start to finish, depending on an organization’s security maturity and the extent of any gaps. Multi-property groups face compounding complexity, and a regional group with eight properties must validate eight environments plus inter-property connections and every third-party vendor with access.

The alternative is straightforward. A hotel can use a PCI DSS Level 1-certified hotel software provider that keeps raw card data out of the hotel’s environment entirely. Outsourcing payment processing to PCI-validated third parties can allow organizations to qualify for simpler SAQ A validation instead of full ROCs, which reduces the compliance requirement from more than 300 controls to as few as 13 to 22, with no on-site QSA assessment required for the hotel itself.

Ready to see how Stayntouch Pay handles this for your property? Schedule a consultation and speak with a specialist.

How Much Does PCI DSS Certification Cost?

Beyond the operational complexity of self-managed compliance, the financial burden is equally significant. The cost of PCI DSS compliance scales directly with scope, so the more systems that touch cardholder data, the more controls must be implemented, tested, and evidenced.

For a hotel retaining full cardholder data scope, very large enterprises requiring a full PCI DSS assessment face total costs of $70,000 or more, with typical components including an on-site audit around $40,000, vulnerability scans around $1,000, penetration testing around $15,000, training and policy development around $5,000, and remediation ranging from $10,000 to $500,000.

For a PCI DSS Level 1 service provider, which is the category that applies to a payment processor handling more than 300,000 transactions annually, PCI DSS Level 1 compliance for a platform or service provider costs up to £1.1 million initially plus approximately £135,000 per year to maintain.

The penalty exposure for non-compliance is significant. Non-compliance with PCI DSS can result in substantial fines, and a card-data breach can trigger significant forensic investigation costs.

By contrast, using a PCI DSS Level 1-certified third-party payment provider to keep card data entirely outside the hotel’s environment can significantly reduce annual compliance costs via SAQ A, which involves far fewer requirements than SAQ D. The hotel shifts the heaviest compliance burden, including the QSA audit, penetration testing, and infrastructure controls, to the certified provider and retains only the obligations that apply to its own limited environment.

Scope Reduction Checklist for Hotel PMS and Payments

Before selecting any hotel PMS or payment solution based on PCI compliance claims, operators, IT directors, and finance leaders should verify the following eight criteria.

1. Request the current Attestation of Compliance (AOC). Ask the vendor for its most recent AOC from a QSA. Marketing language claiming “PCI compliance” does not replace documented certification. Confirm the vendor is listed as a service provider, not only as a merchant.

2. Confirm the service-provider threshold. A PCI DSS Level 1 service provider processes more than 300,000 transactions annually and has completed an annual on-site ROC. Verify the vendor meets this Level 1 threshold described earlier and that the AOC covers the specific services your property will use.

3. Verify tokenization is in use. Tokenization removes the primary account number (PAN) entirely from an organization’s environment, unlike encryption, which leaves encrypted cardholder data in scope because it remains reversible. Confirm that raw card numbers are replaced with tokens before they reach any hotel system.

4. Confirm point-to-point encryption (P2PE) at the point of capture. P2PE encrypts card data at the point of capture so that only the payment processor decrypts it, which keeps raw cardholder data out of the hotel’s own systems. Ask whether the vendor’s terminals and hosted fields use validated P2PE.

5. Identify which SAQ the solution supports. Ask the vendor directly which SAQ their architecture supports for your property. Hotels that fully outsource card capture to a hosted page typically fall under SAQ A, while those that key cards into their own PMS or store them on file usually fall under the broader SAQ D.

6. Assess the integration model and data boundaries. Confirm that connected systems, such as door locks, POS, and the channel manager, receive only the data they need and cannot access raw card data. Scope reduction should be validated by confirming that the gateway or PMS prevents card data from appearing in logs, dashboards, browser scripts, or downstream systems.

7. Evaluate ongoing compliance support. PCI DSS v4.0.1 requires year-round evidence collection, not annual point-in-time validation. Ask whether the vendor provides quarterly ASV scans, supports authenticated internal vulnerability scanning, and maintains script integrity controls on payment pages as required under Requirements 6.4.3 and 11.6.1.

8. Clarify the responsibility matrix. When selecting a PMS payment module, operators must determine exactly which responsibilities remain with the hotel, as this directly determines how much cardholder-data scope is shifted off the property’s environment. Get this in writing before signing.

How Stayntouch Pay Reduces Hotel PCI Scope

Stayntouch Pay is certified to PCI DSS Level 1, the strictest tier of the card industry’s security standard, as a service provider. That certification forms the foundation of how Stayntouch Pay reduces a hotel’s own compliance scope.

The architecture works through two core mechanisms. Tokenization replaces the real card number with a meaningless substitute value the moment a card is presented, so the actual number is never stored in the PMS, and a breach of the hotel’s systems exposes nothing usable. Point-to-point encryption scrambles card data from the moment it is entered until it reaches the processor, so it cannot be read in transit. Together, these controls keep raw cardholder data out of the hotel’s environment entirely and support the lowest applicable SAQ burden for the property.

Stayntouch Pay is built on a cloud-native architecture hosted on Amazon Web Services (AWS), running within a private Virtual Private Cloud (VPC), which is an isolated, dedicated section of cloud infrastructure. The broader Stayntouch platform holds SOC 2 Type 1, which is an independent audit of security controls, GDPR coverage for European data-protection law, and ISO 27001/27018 certifications for information security management and cloud data protection. The security program includes quarterly patching, daily perimeter and application vulnerability scanning, quarterly ASV scans, and annual penetration testing.

Applying the scope reduction checklist above to Stayntouch Pay shows how the platform aligns with these criteria.

• AOC available: Stayntouch Pay holds a current PCI DSS Level 1 service-provider certification. Contact Stayntouch directly to request the AOC.

• Tokenization confirmed: Raw card numbers are replaced with tokens before they reach any hotel system. The PMS stores and works with tokens, not PANs.

• P2PE at point of capture: Card data is encrypted from the terminal or hosted field through to the processor.

• Integration data boundaries enforced: Each connected application, including door locks, POS systems, and the channel manager, is scoped via OAuth, a digital authorization method that grants limited, revocable access, to only the data it needs. A door lock application can see a room number and checkout date but is blocked from payment details or guest addresses.

• Ongoing compliance program: Quarterly vulnerability scans, daily perimeter scanning, and annual penetration testing are maintained by Stayntouch, not delegated to the hotel.

Beyond compliance, Stayntouch Pay consolidates processing, acquiring, and settlement into a single transparent monthly statement, so hotels work with one provider and one bill, with funds settled two business days after transaction. Staff can generate one-click payment links by email, SMS, or QR code. Terminals support tipping prompts and custom authorization amounts. Fraud detection and automated risk management for third-party bookings are included, alongside 24/7 priority payment support.

Stayntouch Pay operates within the broader Stayntouch cloud-native PMS, which connects to more than 1,400 integrations at no additional cost for the integration itself, though each third-party platform charges its own platform fee. That integration library covers revenue management systems (RMS) such as IDeaS and Duetto, POS platforms such as Toast and Oracle Micros, customer relationship management (CRM) tools such as Salesforce and Revinate, door lock systems such as ASSA ABLOY and Salto, and more than 400 distribution channels via the Stayntouch Channel Manager. The platform is designed for hotels of all sizes, with particular depth for properties of 75 rooms and above, multi-property groups, and management companies managing portfolios from a single login.

According to the TravelTech Breakthrough Awards, Stayntouch was named “Hotel PMS Company of the Year” in 2026. The platform holds a 97% customer retention rate and a 94% recommendation rating on Hotel Tech Report.

See how Stayntouch Pay’s Level 1 certification works for your property, and request a personalized demo from the Stayntouch team.

Conclusion: Reducing Hotel PCI Burden with Stayntouch Pay

PCI DSS Level 1 hotel software shifts the heaviest compliance burden, including the QSA audit, the ROC, and the infrastructure controls, from the hotel’s team to the certified provider. Through tokenization and point-to-point encryption, raw cardholder data never enters the hotel’s systems, which reduces the property’s PCI scope to the lowest applicable SAQ and lowers audit costs, remediation risk, and operational overhead.

The transition to PCI DSS v4.0.1 has made scope reduction more important, not less. Year-round compliance obligations, expanded MFA requirements, and payment-page script controls mean that hotels retaining full cardholder data scope face a growing and continuous compliance workload. Partnering with a Level 1-certified provider offers a direct way to contain that workload.

Stayntouch Pay delivers PCI DSS Level 1 certification, tokenization, point-to-point encryption, and a cloud-native architecture on AWS, inside a PMS built for independent hotels, boutique groups, and multi-property portfolios. The platform connects to more than 1,400 integrations at no extra cost for the integration itself, trains staff on the full platform in two days, and provides 24/7/365 support with a guaranteed response under one hour, delivered by hospitality specialists.

Take the next step toward lower compliance scope and stronger payment security, and book your demo with Stayntouch today.

Frequently Asked Questions

What is the difference between a PCI DSS Level 1 merchant and a PCI DSS Level 1 service provider?

This distinction matters for hotels evaluating software vendors. A merchant is the hotel itself, which is the entity accepting card payments from guests. A service provider is a company that processes, stores, or transmits cardholder data on behalf of merchants, such as a payment processor or a PMS vendor that handles payment facilitation. The Level 1 threshold for merchants is more than 6 million card transactions per year across a single card brand. For service providers, the Level 1 threshold is lower at more than 300,000 transactions annually. This means a PMS or payment vendor can be required to meet Level 1 service-provider standards even if no individual hotel it serves processes that volume on its own. When evaluating hotel software, operators should confirm whether the vendor is certified as a Level 1 service provider, not just whether the vendor claims general PCI compliance, because service-provider certification is what allows the hotel to shift cardholder data scope off its own systems.

Does using a PCI DSS Level 1-certified payment solution eliminate my hotel’s PCI obligations entirely?

Using a Level 1-certified provider significantly reduces a hotel’s PCI scope and audit burden, but it does not eliminate all obligations. The hotel still needs to complete the appropriate Self-Assessment Questionnaire, maintain network security controls, train staff on data-handling procedures, and confirm that cardholder data does not leak into non-secure channels such as emails, voice recordings, or messaging tools. What changes is the type and volume of controls the hotel must demonstrate. A hotel that routes all card capture through a certified provider’s tokenization and hosted payment infrastructure may qualify for SAQ A, which covers approximately 13 to 22 requirements with no on-site QSA assessment, rather than SAQ D, which covers more than 300 requirements and may require a full Report on Compliance. The hotel’s acquiring bank confirms which SAQ applies based on the specific payment flow in use.

How does Stayntouch Pay protect my hotel from chargebacks and payment fraud?

Stayntouch Pay addresses payment risk through several layers. Tokenization ensures that raw card numbers are never stored in the PMS, so a breach of hotel systems does not expose usable cardholder data. Point-to-point encryption protects card data from the moment it is entered at a terminal or hosted field through to the processor, which prevents interception in transit. Fraud detection and automated risk management for third-party bookings, such as virtual credit cards from online travel agencies (OTAs), are built into the platform. On the chargeback side, Stayntouch’s Digital Registration Cards capture signed terms and conditions from guests at check-in, which creates a documented record that provides evidence when a guest disputes a charge with their card issuer. Stayntouch Pay also provides 24/7 priority payment support, so when a payment issue arises, a specialist is available immediately rather than routing through a general support queue.

What SAQ type should my hotel expect to qualify for when using Stayntouch Pay?

The applicable SAQ depends on the specific payment flow your property uses and is ultimately confirmed by your acquiring bank. Hotels that fully outsource card capture to a hosted payment page or certified tokenization environment, where raw card numbers never touch the hotel’s own systems, typically qualify for SAQ A, the least burdensome validation path. Hotels whose payment flows involve any direct handling of card data by hotel systems may fall under SAQ A-EP or SAQ D, which carry more extensive requirements. Stayntouch Pay’s architecture, which combines tokenization, point-to-point encryption, and hosted card capture, is designed to support the lowest applicable SAQ for each property. Before finalizing your compliance approach, work with a Qualified Security Assessor to validate that your specific integration qualifies for the SAQ type you are targeting, because PCI DSS v4.0.1 requires annual scope validation and documented evidence of the cardholder data flow.

How does PCI DSS Level 1 certification fit into Stayntouch’s broader security posture?

PCI DSS Level 1 certification for Stayntouch Pay is one component of a broader security program. The Stayntouch platform runs on AWS within a private Virtual Private Cloud (VPC), which provides dedicated, isolated cloud infrastructure. The platform holds SOC 2 Type 1 certification, an independent audit of security controls at a point in time, as well as GDPR coverage for European data-protection requirements and ISO 27001/27018 certification covering information security management and the protection of personal data in the cloud. The security program includes quarterly system-wide patching, daily perimeter and application vulnerability scanning, quarterly ASV scans, annual penetration testing, and annual security and secure-coding training for all Stayntouch employees. Integration access is scoped through OAuth so that each connected application, such as a door lock system, a POS platform, or a revenue management tool, can access only the specific data it requires, which prevents a breach in one connected system from exposing the hotel’s full data environment.