I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business.
At one point, I have two choices:
1) Customers submit payments at a different web address (i.e. separate website for checkout/payment)
2) Customers submit payments on my website (i.e. checkout/payment is part of my website)
I am using a third-party JS widget to handle the entire e-commerce side, which is provided by BookingBug Ltd, a PCI-compliant entity. With this widget, the payment data never touches my server, so I have no card data environment. Notably, I don't control the JS; it is dynamically loaded via a URL under BookingBug Ltd's control. Am I number 1) or 2)?
I started working with 2), but none of the followup questions seemed to apply. Moreover, they seemed far more involved than the average business owner could answer reasonably.