Your SAQ depends on how you handle card data. Hosted pages typically qualify for SAQ A. Hosted fields with merchant page control often mean SAQ A‑EP. Terminals without storage suggest SAQ B/B‑IP. Software and virtual terminals point to SAQ C/C‑VT. Everything else defaults to SAQ D.
Reduce scope with tokenization and E2EE; keep systems patched and limit access to admin accounts.