I was part of a team that developed an e-commerce website (built with Wordpress & WooCommerce) for a client. They use StripeJS and PayPal Standard to process payments, and the site is hosted on a dedicated server with TLS from a trusted certificate authority. The client's digital security manager determined they needed PCI-DSS SAQ A-EP (which tallies with what Stripe themselves say). So far, so good.
However, now the client's bank have requested copies of their PCI SAQ, and asked us (as the website developers) to fill out a copy of the same SAQ in addition to the client's/merchant's copy. The bank have also separately asked for the hosting company to do the same.
As far as I'm aware, SAQ A-EP is only applicable to the merchant. We can certainly help them to fill it out, but I don't think we're supposed to be doing a separate one. Someone in the office suggested we should fill out SAQ-D and submit that instead, but as far as I can determine, SAQ D is supposed to be for merchants who don't fulfil any other SAQ category. I've suggested we push back on this, as it all seems a bit unclear.
Should we, as web developers (who are not at all involved with either hosting or payment processing), be completing a separate SAQ document when the merchant themselves are compliant with SAQ A-EP?
Note: at present we don't have a contractual liability clause with them, as the site quickly evolved from a static brochure to full online store in a very short period of time. We will be remedying this shortly.)