This page outlines how different integration methods affect your PCI responsibilities.

Hosted / Form-Based Integrations

If you use:

Then sensitive cardholder data is processed by PayFast.

In these cases, your PCI scope may be significantly reduced (commonly aligned with SAQ A).

You must ensure that:

API-Based Integrations

If your integration:

Then your PCI scope increases.

You may be required to complete more extensive PCI validation (for example SAQ D), depending on your architecture.

If using tokenization:

Developers are responsible for ensuring that:

This documentation does not replace PCI DSS guidance.
Merchants remain responsible for validating their own compliance obligations.