Web Hosting Talk : Web Hosting Main Forums : Running a Web Hosting Business : PCI Compliance

[TheChemist]

I was reading the thread that was listed in the WHT newsletter regarding PCI Compliance.

I am wondering. Does a host that only accepts PayPal currently and does not accept any other payment methods need to become PCI Compliant?

If a shared/reseller/vps hosting company does get a merchant account but does not store cards on file locally do they need to be PCI Compliant.

[plumsauce]

It is usually the storage of credit card info that kicks PCI into gear. Even if you store it elsewhere, the elsewhere has to be PCI ocmpliant.

Of course, the requirements for being PCI compliant vary with volume such that the requirement might be zero.

[TBradley]

Originally Posted by HS-CB Matt

I was reading the thread that was listed in the WHT newsletter regarding PCI Compliance.

I am wondering. Does a host that only accepts PayPal currently and does not accept any other payment methods need to become PCI Compliant?

If a shared/reseller/vps hosting company does get a merchant account but does not store cards on file locally do they need to be PCI Compliant.

The only reason you would normally need PCI compliance is when you are sotring credit cards on your server or "piece of a server". You would not need it for PayPal, since you are directed to a different PayPal page for actual payment.

[magnafix]

Store, process, or transmit. If the payment form is on your server but POSTs elsewhere, you're transmitting credit card data and must be compliant.

And there's also Appendix A for entities that provide shared hosting.