(disclaimer - I work for WePay which is another payment processor) If you are collecting credit card numbers in your application, then you are still required t

(disclaimer - I work for WePay which is another payment processor) If you are collecting credit card numbers in your application, then you are still required to be PCI compliant (see TOS for the companies you've mentioned). The reasons are obvious: if your servers are hacked or you have a malicious (or just incompetent) employees then the credit card data will be at risk. Thus you will still need to do SDLC, firewalls, HTTPS, and a few other things. If you don't want to deal with PCI at all then you might want to checkout the iFrame checkout from WePay. This way you are completely isolated from the credit card data and PCI while you still keep the user on your website.