Does PA-DSS apply to a SaaS eCommerce system?

Question

My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers have no control over the source code. They cannot deploy on their own hardware; they have to lease the software from us.

I am being asked by a vendor if we are PA-DSS compliant. According to the PA-DSS Requirement and Security Assessment Procedures v2.0:

PA-DSS does NOT apply to payment applications offered by application or service providers only as a service (unless such applications are also sold, licensed, or distributed to third parties) because:

1. The application is a service offered to customers (typically merchants) and the customers do not have the ability to manage, install, or control the application or its environment;

2. The application is covered by the application or service provider’s own PCI DSS review (this coverage should be confirmed by the customer); and/or

3. The application is not sold, distributed, or licensed to third parties.

I am trying to understand if we would fall under those criteria. It sounds to me like we would, because we are in full control over the software; we are the application service provider and the software is provided only as a service. Our customers do not have the ability to install or manage the applications' environment, only our staff does. Our clients can of course use the application to create products and view their orders, however all installation and server maintenance is done by us.

We are fully PCI compliant.

Does PA-DSS apply to a custom hosted eCommerce application like this, when the code and environment is totally managed by the vendor?

Answer 1

PA-DSS does NOT apply to payment applications offered by application or service providers only as a service (unless such applications are also sold, licensed, or distributed to third parties) because:

1. The application is a service offered to customers (typically merchants) and the customers do not have the ability to manage, install, or control the application or its environment;

2. [does not apply by my reading]

3. The application is not sold, distributed, or licensed to third parties.

They cannot deploy on their own hardware; they have to lease the software from us.

Also note: third parties means your clients clients. You're not exactly letting your clients clients use the software in question are you? (ignoring the shopping cart function, that's not the part that is in question here)

Our clients can of course use the application to create products and view their orders, however all installation and server maintenance is done by us.

It wouldn't really be a product if this weren't true. IE: all products must have this capacity, so that can be dismissed from the consideration.

---

I believe, from reading your question/claims, that the product you're using is indeed covered. If you ever let the customer's see the entirety of the billing process then it would not be, in my opinion. But because you control the infrastructure and just give them access to the pertinent parts, you're covered.

That's my lay-person's reading.