Skip to main content

​
PCI Compliance and Your WeGive Account

If your organization is completing a PCI Self-Assessment Questionnaire (SAQ) or has questions about your PCI compliance obligations as a WeGive customer, here is how WeGive’s payment architecture affects your scope.

​
Your donors’ card data never touches your systems

When a donor enters their card information on a WeGive checkout page, the card number and security code are typed into secure, isolated input fields hosted by a PCI-certified vault provider. These fields are completely separate from your website — your site cannot read the raw card data from them. The vault provider tokenizes the card data (replaces it with an opaque, non-reversible reference) before anything reaches WeGive’s servers. WeGive then uses only that token — never the original card number or security code — when processing the payment with your payment processor. The same applies to bank account information: routing and account numbers are tokenized by the vault provider before WeGive handles them. The result: your organization’s website and systems never receive, transmit, or store raw cardholder data when using WeGive’s standard checkout.

​
What SAQ type typically applies

Because WeGive’s checkout fully outsources the card-entry fields to a PCI-certified third party’s secure inputs, organizations using WeGive’s standard checkout flow typically qualify for SAQ A — the simplest PCI self-assessment type. SAQ A applies to merchants who have fully outsourced all payment-page functions that handle cardholder data to PCI DSS compliant service providers. A few important notes:
  • This applies to the standard WeGive checkout flow. If your organization has built a custom integration that collects card data in your own form fields outside of WeGive’s checkout, your PCI scope may be broader.
  • The SAQ type determination is your organization’s responsibility, based on your specific environment. WeGive’s architecture makes SAQ A possible for the standard flow, but your organization should confirm this with your payment processor or a Qualified Security Assessor (QSA) if you have questions about your specific situation.
  • SAQ categories are defined by the PCI Security Standards Council and may change over time.

​
Processor compliance programs

Your payment processor (such as Payrix or Finix) may run its own merchant compliance program that requires you to complete a PCI self-assessment through the processor’s portal. These are processor-level requirements that operate independently of WeGive — WeGive support cannot complete or bypass them on your behalf. If you received a notice from your payment processor about PCI compliance, follow the instructions in the processor’s communication. WeGive support can confirm which processor your organization uses, but the compliance program itself is managed by the processor.

​
Questions?

If you have questions about how WeGive’s payment architecture affects your PCI compliance posture, reach out to WeGive support. For questions about a specific processor’s compliance program, contact the processor directly or follow the instructions in their compliance portal.
Last modified on October 19, 2026