We have a SaaS application which requires the user to submit payment info upon sign up. Subscription fee is charge monthly. And we have to be complaint with PCI DSS.
Now, we are planning to use a marketing platform, such as hubspot / salesforce marketing cloud, to host our landing pages and automate our marketing effort on their platform. We wanted to embed our subscription form in an iframe on the landing page hosted on their platform. The landing pages will have a different domain origin (e.g. offers.mysaas.com) from the sign up form page (e.g. www.mysaas.com). offers.mysaas.com will only be allowed to render the sign up form via
In order to be complaint with PCI DSS, does the 3rd party landing page hosting service also have to be PCI DSS complaint? If not, is there any requirement that 3rd party service need to meet?