Do I need PCI compliance if I use a hosted checkout for food orders?

Yes, but only the simplest kind. With a hosted checkout such as Stripe Checkout, card details are typed on the provider's page, so you qualify for the simplest questionnaire, SAQ A.

• PCI rules apply to anyone who stores, processes or sends card data. Compliance is shared between you and the payment provider.
• Stripe Checkout shows the card fields on Stripe's own domain, so card data never touches your servers.
• SAQ A is for merchants who fully outsource card handling and never store or process card data themselves.
• Since 31 March 2025 you also confirm that your site is not susceptible to attacks from scripts.