What a Qualified Integrator and Reseller (QIR) is
A QIR is an installer or systems professional qualified through a program administered by the PCI Security Standards Council (PCI SSC). The program provides procedures and training for securely installing and maintaining payment applications in a merchant environment.
Your payment application connects to systems that handle card payments. A poor installation or an unsecured remote connection can expose payment systems and card data. A QIR qualification addresses installation and maintenance practices, not your business's overall PCI DSS compliance.
A QIR helps secure payment-system installation, but your business remains responsible for PCI DSS compliance.
What a QIR does for your business
A QIR installs, configures or maintains payment applications and related systems using the program's security procedures. PCI SSC lists successful QIRs and requires them to requalify every year to keep their professional status and listing, as of 2026.
QIR is a PCI security qualification, while Value Added Reseller (VAR) describes a business that resells products or services along with added support or integration. A company could operate as a VAR and employ a QIR, but the terms describe different things: one is a business model, the other is a PCI SSC qualification.
What QIR status means for costs and risk
QIR status does not set your interchange, network fees or processor markup, and it does not create a card-network processing fee. The PCI SSC program requires a training invoice for approved candidates, but does not set a standard merchant price for installation or support services.
The business impact is security and compliance exposure, not a lower processing rate. For example, an integrator's remote access to your point-of-sale system needs controls such as two-factor authentication, access limited to known IP addresses, unique credentials and activity logs. QIR procedures support safer work, but you remain responsible for your environment and PCI DSS obligations.
What you can actually change
You choose who installs and supports your payment applications, and you can limit how that provider reaches your systems. A QIR listing is a useful qualification check, not a substitute for reviewing access and maintenance practices.
- Confirm the individual is listed as a QIR on the PCI SSC website and has current qualification.
- Require two-factor authentication, unique remote-access credentials and access limited to known IP addresses.
- Disable remote access when it is not needed, keep remote-management software patched and review its logs for unknown activity.
- Keep your own PCI DSS validation and security responsibilities separate from the integrator's QIR status.
- Verify the listing. Search the PCI SSC QIR list and confirm the professional's qualification is current before authorizing system work.
- Set access rules. Document approved remote-access methods, named accounts, two-factor authentication and the times when access is permitted.
- Review the service scope. Separate installation and support charges from card-processing fees, then confirm exactly which systems and maintenance tasks the service covers.
Frequently asked questions
Does hiring a QIR make my business PCI compliant?
No. A QIR follows procedures for securely installing and maintaining payment applications, which supports your PCI DSS efforts. Your business remains responsible for its own PCI DSS scope, controls and validation.
Is a QIR the same as a Value Added Reseller?
No. A Value Added Reseller describes a business that resells products or services with added support or integration. QIR is a PCI SSC qualification for professionals who install and maintain payment applications securely. A business can be both.
Does a QIR charge appear as a payment-processing fee?
QIR status does not create an interchange or card-network fee. The PCI SSC program does not set a standard merchant price for installation or support, so review any service charge as a separate business expense.