That distinction doesn’t matter, and you shouldn’t do that, unless you want that portion of your code to be considered in scope for an auditor. If your code tou

That distinction doesn’t matter, and you shouldn’t do that, unless you want that portion of your code to be considered in scope for an auditor. If your code touches card data, it’s in scope. No matter where it runs. Edit: a brief explainer of what is considered in scope. https://secureframe.com/blog/pci-scope https://secureframe.com/blog/pci-scope