PCI DSS is the security standard set by the card networks (Visa, Mastercard and others). It sounds like something only banks worry about, but it applies to anyone who accepts cards, including a small shop with ten orders a month.
The good news is that you can avoid almost all of the burden by one decision: never handle card numbers yourself. Here is what that looks like in practice for a store selling in Saudi Arabia, the UAE or elsewhere in the Gulf.
Yes, it can be very safe, as long as card details never touch your own server. Use a certified payment gateway with a hosted checkout, serve everything over HTTPS, and you carry only the lightest level of PCI responsibility.
The one rule: never touch the card number
When a customer types a card number into a form on your site, and that form posts to your server, you are in scope for the heavy parts of PCI. When the number goes straight from the customer's browser to the payment provider, you are not.
Regional gateways such as Moyasar, HyperPay, Tap and PayTabs, and international ones such as Stripe, all offer a hosted payment page or embedded fields that do exactly this. Your site only receives a result: paid, failed or pending.
What a small site should have
Treat this as your minimum checklist before taking the first real order:
- A certified gateway with a hosted page or embedded fields, not a home-made card form.
- HTTPS on every page, including the cart and the thank-you page.
- 3-D Secure switched on, which is mandatory for most local cards anyway.
- Local methods your customers trust, such as mada, Apple Pay and, where it fits, buy-now-pay-later options like Tabby or Tamara.
- Secret API keys kept in server settings, never inside the page code or a public repository.
What you must never do
Never store card numbers or the three-digit security code, not in a database, a spreadsheet, a chat or an email. Never ask customers to send card photos on WhatsApp. If a customer wants to pay that way, send them a payment link instead.
Also keep admin accounts safe: strong unique passwords, two-step verification on your gateway dashboard, and removal of access for anyone who has left the team.
Your yearly paperwork
Merchants using a hosted page usually fill in the simplest self-assessment questionnaire once a year, often through the gateway's own dashboard. Requirements differ between providers and banks, so check your provider's current terms and ask what they expect from you.
With Uttra you can describe it in chat: "Add a checkout using a hosted payment page from my gateway, show mada and Apple Pay, and keep the API key in settings." You then preview the flow, run a test payment in the provider's test mode, and publish.