0

We have a SaaS application which requires the user to submit payment info upon sign up. Subscription fee is charge monthly. And we have to be complaint with PCI DSS.

Now, we are planning to use a marketing platform, such as hubspot / salesforce marketing cloud, to host our landing pages and automate our marketing effort on their platform. We wanted to embed our subscription form in an iframe on the landing page hosted on their platform. The landing pages will have a different domain origin (e.g. offers.mysaas.com) from the sign up form page (e.g. www.mysaas.com). offers.mysaas.com will only be allowed to render the sign up form via X-Frame-Options: ALLOW-FROM

In order to be complaint with PCI DSS, does the 3rd party landing page hosting service also have to be PCI DSS complaint? If not, is there any requirement that 3rd party service need to meet?

Thanks

2

In order to be complaint with PCI DSS, does the 3rd party landing page hosting service also have to be PCI DSS complaint?

Yes.

If you're talking about sending your customers off to subscribe via an iframe, you're probably hoping to manage your PCI Compliance under SAQ A. Part 2f asks:

Does your company share cardholder data with any third-party service providers (for example, gateways, payment processors, payment service providers (PSP), web-hosting companies, airline booking agents, loyalty program agents, etc.)?

and after you list them out, it reminds you:

Note: Requirement 12.8 applies to all entities in this list.

which, among other requirements, asks:

12.8.4 - Is a program maintained to monitor service providers’ PCI DSS compliance status at least annually?

Someone like Salesforce is, in fact, a PCI-compliant Service Provider which as reflected in the Visa Global Registry of Service Providers. Salesforce themselves has an answer in their knowledge base making it easier for their customers to get the attestations they need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.