Yes. A card processor will take a deposit for a plumbing company the same way it takes one for a shoe shop. The limits that actually bite are not technical. They come from your state’s contractor law, which says how big a deposit can be and when you may take it, and from the card industry’s rules about the page a card number gets typed into.
Your state decides how big the deposit can be
Two states, two very different numbers.
California Business and Professions Code section 7159.5, published on the state’s Legislative Information site, says this: “If a downpayment will be charged, the downpayment shall not exceed one thousand dollars ($1,000) or 10 percent of the contract amount, whichever amount is less.” Read the dates on that page carefully. The section carries its own line that it “shall become operative on July 1, 2021”, and the citation underneath it shows the section was last amended by Stats. 2023, Ch. 403, effective January 1, 2024.
The Contractors State License Board says the same thing in plainer words on its page “Learn About Home Improvement Contracts”, and adds the threshold that puts you under the rule: “In California, a written contract is required for all home improvement projects over $500.” That page carries no update date.
Maryland runs a different number entirely. The Maryland Home Improvement Commission, part of the state’s Department of Labor, says on its home improvement contracts page that “a contractor cannot accept more than 1/3 of the contract price as a deposit”. That page carries no update date.
Put a $30,000 job through both. In California the deposit is capped at $1,000. In Maryland it is capped at $10,000. Same trade, same size job, ten times the gap.
This is not legal or tax advice. Deposit caps are state law, they vary that widely, and some states set none at all. Look up your own state licensing board and ask your own attorney before you put a number on your site.
The deposit belongs to a signed contract, not to a web visit
Maryland is blunt about the order of events. A contractor “may not accept any payment until the contract is signed.”
California ties the money to the paperwork too. The license board says “There must be a detailed, written payment schedule in the contract”, and that “The payments to the contractor cannot exceed the value of the work performed”, with the down payment as the one exception. The same page says a home improvement contract must “inform the consumer of their rights to cancel or rescind the contract.”
This is not legal advice either. The payment order and those cancellation rights are set state by state. Your own licensing board and your own attorney are the authority on what your contract has to say and when you may take money.
Read those together and the shape of the thing changes. A big “Pay your deposit” button that any stranger can press on your home page is the wrong shape. Nobody has signed anything yet, and the amount you are allowed to take depends on a contract price that does not exist yet.
The shape that fits is quieter. You visit, you price the job, the customer signs, then you send that one customer a link to pay. The link covers one named job at one agreed price.
That makes a deposit link a different animal from a public price list. Whether you show any numbers openly is its own decision, worked through in should you put prices on your contractor website.
Where the card number gets typed is the expensive part
The PCI Security Standards Council writes the rules for handling card data. In a post dated 20 Aug, 2024, titled “Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x”, the Council wrote: “Of the 64 new requirements, 51 are future-dated and will be effective as of 31 March 2025.”
Two of those land on anyone whose own web pages touch a payment. They are numbered 6.4.3 and 11.6.1. The Council’s post of 10 Mar, 2025, “New Information Supplement: Payment Page Security and Preventing E-Skimming”, says they “focus on ensuring that payment page scripts are properly authorized, checked for integrity, and monitored for tampering.”
In plain words: if a card number is typed into a form you built, you are expected to keep a list of every small piece of code running on that page, show that none of them has been altered, and watch for changes. That is ongoing work, month after month. It is not a thing you install once and forget.
The way out is in the Council’s own words. Its FAQ article on how an e-commerce merchant meets the SAQ A eligibility criteria for scripts, dated February 2025, says the criteria “does not apply to e-commerce merchants with a webpage that redirects customers from the merchant’s webpage to a TPSP/payment processor… or e-commerce merchants that fully outsource payment functions to a TPSP/payment processor.”
So send people out to your processor’s own hosted page or payment link. Do not let anyone build a card form into your pages. A website built for a trade should stay out of the payments business and hand that job to the processor, the way a static site hands off every job it cannot do itself.
One honest limit on all of it. The Council writes the standard, and says on its own About page that “The Council’s role is to develop and maintain standards. We do not monitor the implementation of standards.” It adds that whether you have to comply, or prove that you have, “is at the discretion of organizations that manage compliance programs, such as a payment brand, acquirer, or other entity.” So ask your bank or your payment facilitator in writing rather than taking a web builder’s word for it.
When you should not build this at all
If you close every job at the kitchen table or over the phone, you do not need anything built. Ask your processor whether it gives you a payment link you can text after the visit.
A checkout on your own site earns its keep only if you sell fixed-price work a stranger can buy without a visit. A drain camera inspection. A furnace tune-up at a set price. A yearly service plan. If you do not sell an item like that, skip the whole thing.
Money taken by card is not stickier than money taken by check, either. A card deposit can be disputed and pulled back, and if the customer cancels under the rights your contract has to tell them about, it goes back anyway.
Say the last limit out loud. Nothing above shows that taking deposits online wins you more work. None of these documents measured that. They are rules about what you may do and how to do it safely, and that is all. Nobody should sell you a checkout as a way to get more calls.
An AI assistant can answer “do you take a deposit” at eleven at night, in your own words. It does not take the payment and it does not sign the contract, and what it may say about price has its own limits.
What to do next
Half an hour, mostly reading.
- Open your own state licensing board’s page on home improvement contracts. Write down the deposit cap and the written contract threshold in dollars.
- Ask your attorney whether that cap covers the work you actually sell. Trades and job types are not all treated alike.
- Call your payment processor and ask for a payment link or a hosted checkout page.
- Ask that processor to confirm in writing that the card number never touches your own site, and which self-assessment form you fill in.
- If you close every job in person, stop here. Text the link after the visit and build nothing.
- If you do sell a fixed-price item a stranger can buy cold, give it one page, with the price, the terms, and the refund rule in writing.
No honest builder will promise you more deposits, a ranking, or a call count. The only site Galloping can show you end to end is its own, which scored 100 on Google’s PageSpeed test on desktop and on mobile, when it launched in August 2026. Read what the monthly plans cover before paying for a payment page you might use twice a year.