The new credit card standards including PA-DSS can be quite confusing for software companies.
My question is this: If your software company designs a POS software system (like we do) which utilizes a locally installed 3rd party credit card processor (which is PA-DSS compliant) to encrypt, transmit and process the credit cards, does our POS system have to pass PA-DSS certification then?
The end users enters the data into our custom designed UI / Payment screen in our application. We do not ever store this information at any point in time in a database, text file etc of any kind. The information is taken from the user interface and loaded into variables in RAM and then passed to the 3rd party software system via their locally installed API. The 3rd party processor then encrypts, submits and processes the credit card information and they are PA-DSS compliant.
So, do we need to be since we are not storing, transmitting or processing the credit card data. We are transmitting the credit card information only from RAM to an API call.
Additional Information Below Added to Question - 2011
I have been told that it is not possible for a software system to be pci dss compliant. I have been told that PCI DSS compliance includes the total merchant environment including the network infrastructure, virus scanning, internet access limitations of servers holding cardholder data and more. It is my understanding that a software system, as its own part of certification or in adhering to the standards can only be pa dss compliant. At least, this is my current personal understanding anyway.
The issue with the pa dss requirements for software developers and software companies is that there is no appropriate definition of the word "transmitted".
The standards say:
"PCI DSS applies wherever account data is stored, processed or transmitted"
Well, based on that, we are not storing any card holder information at all, we are not processing any card holder information and we are not transmitting any information across a network or the Internet.
The problem is that "Transmitted" can literally be taken to mean anything and it needs defined appropriately. Moving data from one byte to another could be transmitted, moving it from one application domain to another, moving data across a local network or moving across the internet itself.
In reading the standards, I am under the impression that the people who wrote these standards for pa dss compliance are very unfamiliar with software and that their actual intent was to have the term "transmitted" mean to move data across a network or the internet, which of course we are not doing.
I do not believe they meant "transmitted" to mean, don't move data from one memory address location to another or do not pass data to a pa-dss compliant dll library.
I would hope that because we are not storing, processing or transmitting data over a netowrk or the internet that we would not be expected to pass a $20,000 certification just so that we can call a PA DSS secure dll library to process our cards.