My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers have no control over the source code. They cannot deploy on their own hardware; they have to lease the software from us.
I am being asked by a vendor if we are PA-DSS compliant. According to the PA-DSS Requirement and Security Assessment Procedures v2.0:
PA-DSS does NOT apply to payment applications offered by application or service providers only as a service (unless such applications are also sold, licensed, or distributed to third parties) because:
The application is a service offered to customers (typically merchants) and the customers do not have the ability to manage, install, or control the application or its environment;
The application is covered by the application or service provider’s own PCI DSS review (this coverage should be confirmed by the customer); and/or
The application is not sold, distributed, or licensed to third parties.
I am trying to understand if we would fall under those criteria. It sounds to me like we would, because we are in full control over the software; we are the application service provider and the software is provided only as a service. Our customers do not have the ability to install or manage the applications' environment, only our staff does. Our clients can of course use the application to create products and view their orders, however all installation and server maintenance is done by us.
We are fully PCI compliant.
Does PA-DSS apply to a custom hosted eCommerce application like this, when the code and environment is totally managed by the vendor?