We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't stored at our servers.
Which PCI DSS SAQ applies to us? Which PCI DSS requirements should we conform to?