IMPORTANT: The SAQ A guidance for Manifold's online card charging is for the ONLINE channel only. If your shop also takes cards in person at the counter using a physical terminal (a swipe, dip, or tap device), that's a separate PCI channel with its own self-assessment form. Filing the wrong form can invalidate your compliance.
The form you need for in-person depends on your terminal
- **SAQ P2PE.** Use this if your terminal is on the PCI SSC's "P2PE-listed" list AND your card processor enrolled you in their Point-to-Point Encryption program. P2PE terminals encrypt the card at the read head, so the rest of your network is out of scope. Easiest in-person SAQ if it applies.
- **SAQ B-IP.** Use this if your terminal connects to your card processor over the Internet (or a private IP line), AND your shop's network has no other card-data systems on it. This is common for modern countertop terminals.
- **SAQ B.** Use this if your terminal is dial-up only (uses a phone line, not the Internet). Rare in 2026 but still around for some legacy installs.
- **SAQ D-Merchant.** Use this if none of the above fit. This is the longest form. Try to avoid it by choosing a P2PE-listed or B-IP terminal instead.
If you're not sure which one applies, ask your card processor. They know what equipment they sold or enrolled you on and which SAQ matches.
What this means in practice for a shop using Manifold
- You file the SAQ A annually for Manifold's online card charging (see "How to fill out your SAQ A self-assessment").
- You file a separate SAQ (one of the above) annually for your countertop terminal.
- Both go to your card processor; both are independent of Manifold.
- The two channels are NOT combined. Each one stands on its own.
If you don't have a countertop terminal and you only take cards through Manifold's "Charge Card" panel (online), this article doesn't apply. You only need the SAQ A.