Merchants are either required to be PCI DSS compliant themselves or outsource their card-handling only to third-party entities who are PCI DSS compliant themsel

Merchants are either required to be PCI DSS compliant themselves or outsource their card-handling only to third-party entities who are PCI DSS compliant themselves. So, one of two things is true: -- Paymentiframe/tarsnap is a PCI DSS compliant third party -- the merchant is intentionally violating the PCI DSS rules by sending credit card data to you So, which is it?