New Zealand’s Qualified Security Assessor
Achieve PCI
DSS compliance,
and stay there.
Confide is New Zealand’s local QSA team. We turn compliance from
a once-a-year scramble into something your organisation can carry
year round.
15+ years
New Zealand’s longest-serving independent QSA company, assessing
merchants and service providers against PCI DSS.
Our process
Four steps from where you
stand to staying compliant.
-
Scope
A scoping assessment that maps exactly where you stand today.
-
Assess
A formal QSA review against the Standard, every control tested and evidenced.
-
Attest
Achieve and document compliance, an SAQ or Report on Compliance you can hand over.
-
Sustain
An ongoing programme so you stay compliant year-round, not just at audit time.
Our Services
Six services, one team behind all of them.
Why confide
Independence isn’t
a claim. It’s our
whole business.
We have been assessing New Zealand organisations
against PCI DSS for more than fifteen years, longer than
any other QSA in the country. In that time the Standard
has changed four times, and we have watched a lot of
good businesses be told what to do without ever being
told why.
We work the other way around. We learn your
environment first, explain in plain English what the
Standard actually asks of you, then help you meet it
in a way that fits how you already operate. Assurance is the
only thing we sell, so there is nothing else we are
steering you towards.
Independent
Assurance is all we do, so our advice is unbiased.
Qualified
An experienced team of Qualified Security Assessors.
Local
NZ-based and NZ-owned, covering ANZ and the wider APAC market.
Long-term partner
Ongoing, sustainable compliance, not a one-off tick-box.
Full-service
Assessment, scanning, policies, training and consulting under one roof.
Proven and trusted
A track record New Zealand businesses rely on.
insights
Related reading.
Practical guidance from our assessors on what the Standard
actually asks of you, written for New Zealand merchants and
service providers.
Diagram Your Processes
When you think of PCI DSS, you probably don’t automatically think of drawing diagrams. But diagrams are vital to understanding your scope,…
5 min read
Version 4 – It’s Actually Coming Soon!
We’ve been mentioning it for years now, but in some exciting PCI DSS news, Version 4.0 is actually coming soon. On 22…
PCI as a Project Manager
You’ve just finished a project successfully, on time, (mostly) on budget, and maybe even exactly what was asked for. You turn up…
6 min read
Protecting Payments Over the Phone
It’s not uncommon to take payments by phone. Whether you’re a small business, a charity, or a large retailer; there may be…
Accepting Payments by Mail? What You Should Know
While purchases online are more common than payments being mailed in on a form, we know that sometimes this is the easiest…
PCI DSS Version 4 – When’s It Coming?
Probably one of the most frequent questions we get at the moment is around when Version 4 of the PCI DSS will…
Common questions
Straight answers,
before you commit.
Still weighing it up? A short discovery call
answers the rest.
A Qualified Security Assessor is a company accredited by the PCI Security Standards Council to formally assess an organisation against PCI DSS. Using a QSA means your compliance is independently validated and accepted by acquirers, card schemes and regulators, not simply self-asserted.
If your organisation stores, processes or transmits cardholder data, or can affect its security, PCI DSS applies. Your bank or payment provider ultimately sets your obligation; we help you confirm exactly what applies and the simplest way to meet it.
It depends on your scope and readiness. A well-scoped environment with evidence in order can complete in a few weeks; larger or first-time assessments take longer. A short scoping call gives you a realistic timeline before you commit to anything.
A Self-Assessment Questionnaire (SAQ) is a validation you complete yourself for lower-risk profiles. A full assessment is a formal QSA review ending in a Report on Compliance (RoC). Which one applies depends on your transaction volume and how you handle card data, we’ll confirm the right path.
Yes. Compliance is a point in time; staying compliant is a programme. Our Managed Assurance keeps controls, scanning and evidence current year-round, so your next assessment is routine rather than a scramble.
Ready to get compliant,
and stay compliant?
Book a discovery call with a Qualified Security Assessor.
We’ll tell you where you stand and exactly what to do next.