5

We are hosting a site on a self-managed Digital Ocean VPS ("Droplet") that will be taking payments via Stripe using their stripe.js API. According to PCI, we have determined that we fall under the SAQ A-EP.

However, the SAQ A-EP (Part 2g) states that:

If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g., including PCI DSS Appendix A if the provider is a shared hosting provider)

What I am having trouble understanding is the following:

  1. Since we are on a VPS provided by Digital Ocean, are we considered to be using "shared hosting" from a third-party provider? Or are we considered to be self-hosted, since the VPS is self-managed and Digital Ocean has no shell access to our box?
  2. Does Appendix A need to be satisfied? If so, by whom?
  3. If we are considered self-hosted, do we satisfy the following requirement (also in Part 2g), since our VPS has its own IP address and we are the only ones with access to the VPS?

    Merchant’s e-commerce website is not connected to any other systems within merchant’s environment (this can be achieved via network segmentation to isolate the website from all other systems)

Improve this question

2 Answers 2

Reset to default
6

First, let me say I agree with your assessment that the SAQ A-EP is what you should be using (assuming your volume qualifies you for Level 3 or 4, less than 1 million annual transactions). This is a huge change to PCI and I imagine it is going to cause some serious ripples in the payments space.

My understanding of the phrase "shared hosting" in terms of PCI does not apply to Digital Ocean or any VPS provider. However, they are still a hosting provider and as such have access to the cardholder data. They do say on their Security page that engineering team employees have access to the backend host servers. It is therefore entirely possible for them to access your Droplet if they wanted.

The way you can think of this is, if they hired a malicious person, could that person access and modify data on your Droplet. If they could modify something on your Droplet, they could add JavaScript to the page to siphon off cardholder data before it is sent to Stripe. Now, I think we would all expect that Digital Ocean has controls in place to monitor/audit these types of things and that is where PCI comes in. They should undergo a PCI Level 1 Service Provider assessment to validate their controls. It looks like this has come up before and they said they were not pursing any sort of PCI compliance at the time.

Improve this answer
2

In my opinion, given the information you provided, the SAQ A-EP fits your scenario.

You are not self hosted and Digital Ocean is your third party provider. Hosting is more than the software you host but also the physical security of the hardware. Digital Ocean likely have access to your data stored on the server, and could alter files on the box that cause the payment pages to change without SSH access. Regardless of whether it classes as shared hosting Digital Ocean still need to be validated to the relevant items of PCI DSS (see below).

I don't know if they would be classed as Shared Hosting though and I'd rely on advice from a QSA on this one. If its not Shared Hosting, get clear justification for why.

In regards to segmentation, most companies will have parts of their systems in-scope and part out of scope. The parts in scope should be segmented and controlled from the parts out of scope. You may wish to make your entire website in scope, or you might wish to break it up into seperately hosted parts. External parties may fall in/out of scope too. e.g. Digital Ocean will be in scope, but the Internet will be out of scope. Secure your in-scope environment using firewalls and other means, so only the traffic intended to and from your environment is allowed.

The SAQ A-EP requires several things in the 'Before You Begin' section that will all be things you should check. A couple I want to call out, that sound real relevant to the questions you're asking:

  1. Your hosting provider needs to be validated to all applicable PCI DSS requirements

    If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements

    Digital Ocean essentially needs to be PCI Compliant, or to some of the requirements at least, for you to be PCI Compliant. Last I checked they aren't. AWS has maintained PCI Compliance for sometime though, and they are a good default for virtualization and PCI.

  2. Don't use external JS, CSS, etc on your pages using StripeJS

    All elements of payment pages that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS compliant service provider(s);

  3. It's your responsibility to make sure your service providers are PCI compliant

    Your company has confirmed that all third party(s) handling storage, processing, and/or transmission of cardholder data are PCI DSS compliant

The above is my opinion and not advice, you should not rely on it, and instead consult a registered PCI QSA for advice. Block quotes are from PCI DSS SAQ A-EP v3. Always read the full SAQ and PCI DSS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .