PCI DSS Compliance for Client

Question

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card details. When they submit the form, a script will send that info to the NetPay API, which will process the transaction and return a status code.

Can someone advise on what PCI stuff we as a business, and the client should be aware of?

I've been direct to the NetPay site, the PCI site, various other provider sites but none of them answered my question really. From what I can see as they're a low transaction (qty) business, they'd need tier 4, but seeing as we're using the API, not a hosted form or anything to do it, it might be different. Please note we're not storing ANY card details, and we will have SSL. Edit: We're also hosting the site through OVH's network, however due to it being API based I imagine the server will need to be in a PCI DSS compliant data centre too...

Thanks in advance folks, Ash

Answer 1

If your e-commerce site neither stores, processes nor transmits PCI data, then you can take what is known as Attestation A. This is what you do when you use a so-called "Payments 2.0" provider, such as CyberCash, etc. Some providers host the form for you, others provide a POST API, or both.

Who hosts the capture form is not so important, but where the POST goes to is -- if the capture comes to your site, you cannot take Attestation A. If it goes to CyberCash (or whoever), you can... since the PCI data never touches your site or your database. In this case, the User's browser transmits directly to the payments provider, not you.

Nevertheless, you still have to engage a QSA to verify your Attestation A eligibility.

Example form: https://www.forte.net/images/Sample_SAQ_A.pdf

Answer 2

I'm not a QSA, but I do have some PCI familiarity. It sounds like you'd want to fill out/comply with "SAQ-D Service Provider" - look in PCI's document library for that.

Your form takes the customer's credit card number, so my understanding is that you are indeed on the hook for PCI.