Accreditations & Certifications
PCI compliance is an industry where anyone can call themselves an expert. Nothing stops a reseller adding a compliance line to your monthly statement and calling it a service. So rather than ask you to take our word for it, this page sets out exactly what we hold, what each qualification actually permits, and where you can verify every claim independently.
Check us in sixty seconds
Every identifier below is on a public register. You do not need to contact us to confirm any of it, and we would rather you checked.
The company you contract with — not a trading name or an intermediary.
Searchable on the Companies House register, including full filing history.
View on Companies HouseRegistered with the Information Commissioner's Office as a data controller, as required of any business handling personal data.
View on the ICO registerContinuously providing PCI DSS compliance services to UK merchants.
A real office in Devon, with a named team you can speak to on the phone.
What our qualifications actually mean
Compliance acronyms get used loosely. Here is what ours cover, in plain terms.
PCI Professional (PCIP)
PCIP is an individual qualification awarded by the PCI Security Standards Council — the body that writes the PCI DSS itself. It is held by a person, not bought by a company, and it has to be kept current rather than earned once and displayed forever.
In practice it means the person reading your card flows understands the standard as the Council intends it: which requirements genuinely apply to your setup, and which ones you can legitimately mark out of scope. Most of the money merchants waste on compliance is spent answering questions that never applied to them.
PCI IM (IBITG) Accredited
An accredited assessor qualification covering the implementation side of the standard: turning the requirements into controls a real business can actually operate, and assessing whether those controls hold up.
This is the difference between being handed a self-assessment questionnaire and being walked through it. We complete and file the SAQ with you, write the policies it asks you to evidence, and arrange quarterly scanning where your card setup requires it.
What our accreditations cover — and where they stop
PCI DSS validation takes one of two forms, and which one applies to you depends entirely on how many card transactions you process a year. Being straight about this matters, because plenty of providers are not.
The overwhelming majority of UK merchants. Validation is by Self-Assessment Questionnaire, and our accreditations cover this work in full: choosing the correct SAQ type, completing it, filing it, and maintaining it each year.
Above roughly six million transactions a year, a self-assessment is not permitted. You need an on-site audit by a Qualified Security Assessor. We coordinate that process and prepare you for it — we do not sell you the audit and pretend it is the same thing.
If you are not sure which applies to you, our guide to PCI merchant levels explains the thresholds, or read how the SAQ types differ. Both are free and neither asks for your details.
Accepted by the acquirers you already use
Compliance is filed with your acquirer, not with us — so what matters is that they accept the submission. We work with merchants across all the major UK acquiring banks and card processors, and the certificates we produce are the same ones they ask for directly.
How we hold ourselves to it
Accreditation is a floor, not a finish line. Our pricing is a single published figure of £100 plus VAT a year, so there is no incentive for us to talk you into a more complicated assessment than you need — the fee is the same either way. Where a merchant genuinely does not need us, we say so.
The commitments we make on scope, pricing and data handling are written down in our code of conduct, and the detail of how we handle your data is in our privacy policy. If you want to see the work before committing to it, the case studies set out what we did and what it saved, and the FAQ answers the questions we get asked most.