Yes, Amazon is PCI-compliant, https://aws.amazon.com/security/pci-dss-level-1-compliance-faqs/ https://aws.amazon.com/security/pci-dss-level-1-compliance-f...

Yes, Amazon is PCI-compliant, https://aws.amazon.com/security/pci-dss-level-1-compliance-faqs/ https://aws.amazon.com/security/pci-dss-level-1-compliance-f... This means part of the work is done. Then if the isolated pci-blackbox you are using is also PCI-compliant in how it deals with card data, encryptions, hashes, etc, then what is left is not much, basically mostly documentation, routines in place, etc. I would say you could probably get down to 1% of the normal work of becoming PCI-compliant by, a) Getting rid of the whole hardware part of the problem, by using EC2 and free-riding on the work already carried out by Amazon. Just make sure to use Two-Factor Authentication to access your EC2-instance. b) Use a open sourced PCI-compliant isolated component which only handles the two bare-minimum features it needs to do, which are "encrypt and store card data" and "decrypt card and process payment via PSP".