The deadly scope (SAQ D)
If you see, touch, store or intercept PANs, you're on the hook for the 329-question questionnaire. A breach under SAQ D means USD $50–$90 in fines per record — enough to wipe out the hotel's annual margin in 48 hours.
Critical risk level
Your hotel is required to comply with PCI DSS. It probably doesn't. And the card brands can break it.
If your hotel receives virtual cards from Expedia or Booking, if your front-desk clerk types PANs into a terminal, if you keep a PDF with card data sitting in an inbox, or if your PMS “remembers” a card for incidental charges, your real scope is PCI DSS SAQ D: 329 requirements, annual audit and Visa / Mastercard fines that start at USD $5,000 per month.
The Hotelpay solution
We cut your scope to SAQ A (22 questions) because your hotel stops seeing, touching and storing card data. For good. We tokenize at the OTA and encrypt at the lobby terminal.
Audit-ready evidence for your QSA
We generate the documentary evidence your QSA demands: network diagrams, token flows, signed logs, device inventories, ASV scan reports. Ready to audit.
OTA virtual cards, zero friction
We process Expedia, Booking and Agoda virtual cards inside the vault. Your clerk never sees the PAN, your PMS never stores it, and the hotel complies without changing how it operates.
Stop being the custodian. Start being the beneficiary.
Regulation isn't changing — it's tightening. PCI DSS 4.0 demands more controls, more frequent evidence and more direct responsibility from the hotelier, not the acquirer. The card brands no longer accept "the PMS handles it" as an answer.
Hotelpay intervenes at exactly the point where your responsibility begins: the moment card data enters your property. We tokenize from the OTA channel, from the pre-pay link, from the P2PE lobby terminal. Your hotel processes payments without ever handling them, and your PCI scope shifts from 329 annually-audited requirements to 22 self-reported ones.
The result: you go from spending USD $120K–$300K a year on compliance to a fraction of that. And the QSA stops being your recurring nightmare.
Has your QSA already asked for extra evidence this year?
Book a 45-minute PCI consultation. We'll diagnose your current scope and the reduction roadmap.
Schedule PCI consultation