Setting up a new company with ecommerce app, and looking at PCI compliance.
What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?
The context in which we will be processing payments will be in one of the following scenarios:
Option 1 PayPal pro - credit card information is processed on our domain and website, but is not stored in our database - it is simply transmitted to PayPal.
Option 2 SagePay server & inIframe - credit card information is entered on our website, but never hits our system because the SagePay hosted Iframe sends the data directly to SagePay.
Any advice appreciated. I have read PCI documentation, but still unsure about the process.