I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and does individual projects will look at the source code and will also do penetration tests, etc.

Now while it will make me feel comfortable that somebody who is well-versed with it will be scanning the site and making necessary changes if need be but i am uncomfortable with the fact that that one person will know how we code things and how we process things.

Now i have two options, either i let him test the site on our website that we need it for or i move the site to another domain and call it something else. But I also want him to sign a NDA agreement which will then have to have my company's name on it. So i am sort of lost?

How does one allow third party audits without being vulnerable to them?