Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company provides web applications to third parties. We develop, host and manage the applications ourselves. All access that third parties get is the application itself and a separate management/configuration application which is also a web application, so no system (shell/ftp/etc) access whatsoever.

Are we a shared hosting/service provider?

share|improve this question
Doesn't really seem to be a good fit for security SE. – Terry Chia Jun 27 '12 at 14:45
Where does credit card data fit into this service? Is your service a payment platform? – Cheekysoft Jun 27 '12 at 15:11
You may be best off asking a registered QSA… – Cheekysoft Jun 27 '12 at 15:17

It looks like you could well be if those applications hold credit card data, or you hold credit card data, but you will need to look at the SAQ overview doc, specifically the section on eligibility criteria. Read through it to see what sections apply to you.

share|improve this answer

The question is very vague on detail so I can't give anything definitive. I am Not A QSA or Legal expert. This is purely based on my own PCI experience. I'd always err on the side of caution and ensure all systems are PCI Compliant.

The short answer to your question is yes. If you are hosting them you are a host or service provider.

Now the shared part can be tricky. Shared hosting typically means multiple clients sharing a physical (or virtual) server. In this case it is almost impossible to be PCI compliant as PCI compliance requires isolation of data.

Again the question is vague on details. If you provide more background I can provide a better answer

share|improve this answer

You are not a shared hosting provider.

You are a Service Provider (so, SAQ-D as long as you transmit less than 300.000 transactions per year).

You are also a Cloud Provider / SaaS.

Hope this help.

By the way, you may register your company on PCI Initiative List under the SaaS category.

share|improve this answer
You know, there's absolutely no reason to post a link to PCI Initiative with each post of yours. Add it to your profile and provide good answers, it'll work much better. ;) – TildalWave Jan 13 '14 at 19:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.