3 ms·
Common mistake: just because you don't store credit cards it doesn't mean that this changes anything about your PCI DSS requirements. As long as CCs hit your IP
by xal 16y ago
Common mistake: just because you don't store credit cards it doesn't mean that this changes anything about your PCI DSS requirements. As long as CCs hit your IPs you are responsible for them. Not storing CCs simplifies certain things but you still have to get certified.
- Spark23 16y agoIn this case it should be the PA-DSS. From the PCI page: 'Payment applications that are sold, distributed or licensed to third parties are subject to the PA-DSS requirements.'
- metachris 16y agoExcuse my ignorance, but does that mean I cannot setup this solution without getting certified before? Could you explain what's required for a startup to use this solution?
- xal 16y agoThat's correct.
- brockf 16y agoYes, you do need to get certified if you are performing 20,000+ transactions or $1million per year in credit card revenue. Otherwise, you can do a self-check as you're a Stage 4 merchant.