What processor setup actually works for a small facility?
The simplest path is a processor that hosts the entire payment page on its own servers. Your tenant clicks a link, lands on the processor's page, types in a card number, and the money moves. Your system never touches the raw card data.
That matters because, according to PCI Security Standards Council – Merchant Resources, PCI DSS applies to every merchant that stores, processes, or transmits cardholder data, regardless of size or transaction volume. You are not exempt because you run one facility with forty units.
When you fully outsource the payment page to a PCI DSS-compliant third-party service provider and your own systems never electronically store, process, or transmit account data, you may qualify for the shorter SAQ A self-assessment questionnaire. PCI DSS v4.0.1 is now the only active version as of January 1, 2025, per PCI Security Standards Council – Merchant Resources, so confirm with your processor that their setup meets v4.0.1 requirements, not the retired v4.0.
What changed with PCI DSS in 2025?
PCI DSS v4.0.1 became the only active version on January 1, 2025, after PCI DSS v4.0 was retired. The update introduced stronger multifactor authentication requirements, expanded password protocols, and more rigorous vulnerability management standards, as documented in PCI DSS v4.0 SAQ A – PCI SSC Official Document.
In practice this means your processor login and your management software login need to meet the new authentication rules. If your processor has not contacted you about these changes, call them and ask directly what they have updated on their end and what you need to do on yours.
How do you set up recurring billing so tenants pay automatically?
Start by getting every current tenant enrolled in auto-pay at move-in or at their next payment. Send them a link to the hosted payment page, have them enter their card or bank account once, and the system charges them on the same date every month.
Automated recurring billing combined with payment reminders sent by text and email reduces missed payments and stabilizes monthly revenue. The reminder goes out a few days before the charge, the charge runs, and you see the result in your dashboard the next morning.
One thing that kills auto-pay quietly: a tenant gets a new card because the old one expired or was reissued, and the stored number stops working. Visa and Mastercard operate an Account Updater service that automatically pushes new card numbers to merchants when a card expires or is reissued. Ask your processor whether they participate, because without it you will see a wave of failed payments every time your tenants' banks do a card refresh cycle.
Should you accept ACH payments as well as cards?
Yes, and the main reason is cost. ACH payments cost less to process than credit card transactions. Ask your processor for a per-transaction fee breakdown on credit card and ACH before you sign anything, because the fee structures differ materially.
If you accept ACH, you are subject to Nacha rules. According to Business.com – Payment Processing Laws and Regulations, Nacha rules include risk monitoring, audits, and secure storage and verification requirements for participants in the ACH network. Your processor handles most of this, but you need to know it applies to you and ask your processor how they keep you inside those rules.
For tenants who pay by check, you are still processing a payment type with its own cost and handling time. Some operators keep paper checks for a small number of long-term tenants and push everyone else to card or ACH.
What mistakes cost operators money?
The most common one is writing down card numbers. Writing down or saving card information outside a PCI-compliant system is explicitly identified as a prohibited practice for self-storage payment handling, per PCI Security Standards Council – Merchant Resources. If a staff member takes a card number over the phone and writes it on a sticky note or types it into a spreadsheet, your facility is out of compliance and exposed.
The fix is simple: use a virtual terminal provided by your processor. The staff member reads the card number into the processor's own interface, and the number never lives on your computer or your paper.
The second mistake is ignoring failed payment notifications. Your processor will send you a report of declines. If nobody looks at it until the end of the month, you have lost two to three weeks of collection time on every failed account.
What should you do next?
- Call your current processor or get quotes from two processors that specialize in self-storage. Ask each one: do you host the payment page on your servers, do you participate in Account Updater, and what are your per-transaction fees for card and ACH?
- Confirm that PCI DSS v4.0.1 requirements are met on the processor's side and that your own staff logins use multifactor authentication, as required since January 1, 2025.
- Set up a hosted payment link and send it to every tenant who is not already on auto-pay, with a deadline to enroll.
- Turn on payment reminders by text and email, set to fire three to five days before each billing date.
- Pull your failed payment report weekly, not monthly, and work those accounts before you run out of collection options.
- Train every staff member that card numbers are never written down or stored outside the processor's virtual terminal, and document that training in case you are ever audited.
Where does Propty fit?
When a customer wants to pay, Propty can text them a secure payment link, and online payments go into your own Stripe account.