In this case Twitter is the only company that can secure the page containing the iFrame code: Merchant is responsible for:  Managing website and servers (if

In this case Twitter is the only company that can secure the page containing the iFrame code: Merchant is responsible for:  Managing website and servers (if self-hosted), including applicable PCI DSS requirements  If website/server hosting is outsourced, applicable PCI DSS requirements for management of third parties (e.g., Requirement 12.8)  Having written agreements with any third parties and ensuring that they protect cardholder data on behalf of the merchant, in accordance with PCI DSS  Securing the web page(s) containing the iFrame code.