This doesn't sound right to me. Do you perhaps mean PCI Level 1 compliance (which requires on site data center audits and thus cannot be provided by any cloud h

This doesn't sound right to me. Do you perhaps mean PCI Level 1 compliance (which requires on site data center audits and thus cannot be provided by any cloud host)? For instance, what about Heroku/EC2 prohibits me from using Authorize.net as my payment processor, provided I never store card data?