PCI Compliance

The S710 encrypts card data the moment it's presented to the reader, using end-to-end encryption (E2EE) by default.

The reader sends that encrypted data directly to Stripe and tokenizes it. The POS application only ever receives a Stripe payment token, never raw card data.

Because the POS never handles card data, the POS application itself is out of scope for PCI DSS, regardless of whether the POS and reader share a network.

PCI compliance validation is still required at the merchant level, though. For in-person payments through Terminal, validation uses the SAQ C template (a shorter self-assessment questionnaire reflecting the E2EE architecture), separate from any e-commerce transaction validation.

Pushing PCI scope off their internal network doesn't remove the requirement to validate — it simplifies what's in scope. The S710's E2EE/P2PE architecture is what reduces the scope of what needs to be validated, not the choice of network topology.