I have been looking at an online payment gateway, authorize.net, and specifically their Direct Post Method. This method would allow me to create a form on my server, then submit the post parameters directly to their server for processing. So you never actually leave my site as a customer, but my server can only see the response, not the initial payment information.
A question I have thought about is PCI compliance. I have been reading in the comments of this authorize.net blog. There is an argument over whether or not the server that has the form needs to be PCI compliant. Some say yes, because the form is on your site that has your URL and there is credit card information. Others say no because the form is submitted directly to authorize.net and the credit card information never even hits the merchant's server.
I have read in a few places on their site that Direct Post Method will "simplify merchant PCI compliance" or it will "relieve some of the worries about security". How exactly is PCI compliance simplified? So my question is, does my site need to be PCI compliant and if so how can this simplify it?
A related question is the transaction key. Authorize.net says to securely store the key. How are keys securely stored on a server? (without an HSM) Is this key considered part of PCI?