3 ms·

The key words are “directly accept”. If you use a properly implemented hosted payment page, your systems don’t touch the card data.

• davnicwil 3y ago
  There is a distinction between the frontend user interface running locally in the user's browser and the backend code running on your server. It's possible to 'accept' user input of card details in a frontend that you build and host, so long as you do not submit that data to a server you control -- you instead submit it directly from your frontend to a third party service that is PCI compliant.
  • JoBrad 3y ago
    That distinction doesn’t matter, and you shouldn’t do that, unless you want that portion of your code to be considered in scope for an auditor. If your code touches card data, it’s in scope. No matter where it runs. Edit: a brief explainer of what is considered in scope. https://secureframe.com/blog/pci-scope https://secureframe.com/blog/pci-scope