Process Rite operational guide · Updated August 2026 · Editorial policy
Payment Data Security, PCI Responsibilities, and Employee Access for Small Businesses
A payment-security program is an operating system for people, devices, networks, providers, and incident response—not a certificate filed once a year. This guide separates configuration decisions from legal, tax, compliance, processor, and provider responsibilities that require current written guidance.
Start with responsibility boundaries
The merchant owns its internal procedures and employee access. Payment processors, acquiring institutions, software providers, equipment vendors, network providers, payroll professionals, and advisers may control other parts of the outcome. Record the owner of every decision, preserve current agreements, and verify time-sensitive requirements with the responsible organization.
Control checklist
- Inventory payment channels, devices, software, networks, integrations, user accounts, reports, and support contacts.
- Use named accounts and the least access each role needs. Remove access promptly when duties change.
- Write procedures for ordinary transactions and exceptions. Include approvals, evidence, and escalation contacts.
- Test the procedure with realistic scenarios before relying on it during customer service.
- Reconcile transaction records, batches, deposits, payroll or accounting records as applicable.
- Review the process after provider, equipment, staffing, legal, or operating changes.
How the workflow changes by business type
Quick Service Restaurant
For a quick service restaurant evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Coffee Shop
For a coffee shop evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Bakery
For a bakery evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Deli
For a deli evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Food Truck
For a food truck evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Bar And Nightclub
For a bar and nightclub evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Grocery Store
For a grocery store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Convenience Store
For a convenience store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Liquor Store
For a liquor store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Boutique
For a boutique evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review returns, exchanges, discounts, partial approvals, damaged items, ecommerce refunds, and inventory mismatches. A workflow that handles only the ordinary sale is incomplete.
Clothing Store
For a clothing store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review returns, exchanges, discounts, partial approvals, damaged items, ecommerce refunds, and inventory mismatches. A workflow that handles only the ordinary sale is incomplete.
Jewelry Store
For a jewelry store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review returns, exchanges, discounts, partial approvals, damaged items, ecommerce refunds, and inventory mismatches. A workflow that handles only the ordinary sale is incomplete.
Furniture Store
For a furniture store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review returns, exchanges, discounts, partial approvals, damaged items, ecommerce refunds, and inventory mismatches. A workflow that handles only the ordinary sale is incomplete.
Hardware Store
For a hardware store evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review returns, exchanges, discounts, partial approvals, damaged items, ecommerce refunds, and inventory mismatches. A workflow that handles only the ordinary sale is incomplete.
Auto Repair Shop
For a auto repair shop evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review declines, duplicate charges, partial refunds, disputed payments, failed devices, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Car Wash
For a car wash evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review declines, duplicate charges, partial refunds, disputed payments, failed devices, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Tire Shop
For a tire shop evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review declines, duplicate charges, partial refunds, disputed payments, failed devices, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Salon
For a salon evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Barbershop
For a barbershop evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review split checks, changed tips, voids, refunds, delayed orders, printer failures, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Spa
For a spa evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Nail Salon
For a nail salon evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Gym
For a gym evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Yoga Studio
For a yoga studio evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Martial Arts School
For a martial arts school evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Dental Office
For a dental office evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review copays, deposits, refunds, payment plans, privacy-sensitive conversations, failed payments, and reconciliation differences. A workflow that handles only the ordinary sale is incomplete.
Medical Practice
For a medical practice evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review copays, deposits, refunds, payment plans, privacy-sensitive conversations, failed payments, and reconciliation differences. A workflow that handles only the ordinary sale is incomplete.
Veterinary Clinic
For a veterinary clinic evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review copays, deposits, refunds, payment plans, privacy-sensitive conversations, failed payments, and reconciliation differences. A workflow that handles only the ordinary sale is incomplete.
Pharmacy
For a pharmacy evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review returns, exchanges, discounts, partial approvals, damaged items, ecommerce refunds, and inventory mismatches. A workflow that handles only the ordinary sale is incomplete.
Plumber
For a plumber evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
Electrician
For a electrician evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
HVAC Contractor
For a HVAC contractor evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
Landscaping Company
For a landscaping company evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
Cleaning Company
For a cleaning company evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
Pest Control Company
For a pest control company evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
Roofing Contractor
For a roofing contractor evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
General Contractor
For a general contractor evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review change orders, partial payments, deposits, invoice disputes, failed links, cancellations, and route connectivity. A workflow that handles only the ordinary sale is incomplete.
Property Management Company
For a property management company evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review declines, duplicate charges, partial refunds, disputed payments, failed devices, and missing deposits. A workflow that handles only the ordinary sale is incomplete.
Accounting Firm
For a accounting firm evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Law Firm
For a law firm evaluating payment data security checklist, volume, average ticket, seasonality, locations, staffing, customer expectations, returns or cancellations, and card-present versus card-not-present activity can change the appropriate design. Review cancellations, no-shows, deposits, package balances, recurring failures, refunds, and chargebacks. A workflow that handles only the ordinary sale is incomplete.
Questions to document before configuration
- Which written rule or agreement controls this decision?
- Which employee roles may initiate, approve, correct, or report the activity?
- What records prove that the workflow operated as intended?
- What happens when a device, network, integration, or provider is unavailable?
- Who investigates exceptions and who communicates with customers?
- When will the business review the configuration again?
Primary sources
Use current primary guidance rather than relying on a POS setting or sales description as legal or compliance advice.
- PCI Security Standards Council merchant resources
- PCI DSS overview
- FTC Cybersecurity for Small Business
Request a practical payment-workflow review
Process Rite can help organize the payment workflow, equipment questions, provider responsibilities, and testing plan. Do not submit card numbers, passwords, bank credentials, or other sensitive authentication information.
Request a Free Payments Review
Tell us about your current payment setup and the workflow you want reviewed.
This guide is educational information. Written provider terms and qualified legal, tax, payroll, accounting, and security guidance control where applicable.