My company provides web applications to third parties. We develop, host and manage the applications ourselves. All access that third parties get is the application itself and a separate management/configuration application which is also a web application, so no system (shell/ftp/etc) access whatsoever.

Are we a shared hosting/service provider?


5 Answers 5


Are we a shared hosting/service provider?

The PCI SSC defines what they mean by "shared hosting provider" under the PCI DSS requirement 2.6. The guidance section states:

This [requirement] is intended for hosting providers that provide shared hosting environments for multiple clients on the same server. When all data is on the same server and under control of a single environment, often the settings on these shared servers are not manageable by individual clients. This allows clients to add insecure functions and scripts that impact the security of all other client environments; and thereby make it easy for a malicious individual to compromise one client's data and thereby gain access to all other clients' data. See Appendix A1 for details of requirements.

From your description, you probably are a shared hosting provider but its not clear whether multiple unrelated clients are accessing and storing data on a common set of servers, e.g. 12 clients accessing or running separate instances of your web application one a single web server.

This is exactly how my company operates and we are evaluated for PCI compliance as a shared hosting provider. We have multiple physical servers that run multiple virtual servers on each physical server. While some clients pay for ftp access, that is sand-boxed and will be replaced by a new mechanism within the year. Uploaded files are highly restricted by type, scanned by antivirus, and more. Databases are separate but on shared SQL server instances. In one component, a DB that is considered ours and not the clients' has client data mixed with other client data but essentially every record has a unique key, so only that component knows how decode that client's data for that client.

If this weren't allowed, even PayPal couldn't function because they would need a separate physical server for every merchant client.

The referenced Appendix A1 contains 4 specific sub-requirements, summarized: A1 - Protect each entity's hosted environment and data, per A1.1 - A1.4 A1.1 - Ensure that each entity only runs processes that have access to that entity’s cardholder data environment. A1.2 Restrict each entity’s access and privileges to its own cardholder data environment only. A1.3 Ensure logging and audit trails are enabled and unique to each entity’s cardholder data environment and consistent with PCI DSS Requirement 10. A1.4 Enable processes to provide for timely forensic investigation in the event of a compromise to any hosted merchant or service provider.

The latter 2 can be the toughest, depending on how your logging and forensic data are done.


It looks like you could well be if those applications hold credit card data, or you hold credit card data, but you will need to look at the SAQ overview doc, specifically the section on eligibility criteria. Read through it to see what sections apply to you.


The question is very vague on detail so I can't give anything definitive. I am Not A QSA or Legal expert. This is purely based on my own PCI experience. I'd always err on the side of caution and ensure all systems are PCI Compliant.

The short answer to your question is yes. If you are hosting them you are a host or service provider.

Now the shared part can be tricky. Shared hosting typically means multiple clients sharing a physical (or virtual) server. In this case it is almost impossible to be PCI compliant as PCI compliance requires isolation of data.

Again the question is vague on details. If you provide more background I can provide a better answer


You are not a shared hosting provider.

You are a Service Provider (so, SAQ-D as long as you transmit less than 300.000 transactions per year).

You are also a Cloud Provider / SaaS.

  • 3
    You know, there's absolutely no reason to post a link to PCI Initiative with each post of yours. Add it to your profile and provide good answers, it'll work much better. ;)
    – TildalWave
    Jan 13, 2014 at 19:25

The intention of a shared hosting provider in PCI DSS requirement 2.6 is where more than one entity (merchant or service provider (you in this case)) share resources provided by the shared hosting provider. You are not a shared hosting provider but rather are a SaaS provider of applications which are hosted on your own shared resources which are provided by a hosting provider.

The big distinction is that you are not sharing your resources with other entities (companies, merchants, service providers like you). This follows into the additional PCI DSS requirements for shared hosting providers at Appendix A1 which are also not applicable. The intention of PCI DSS 2.6 and Appendix A1 is relating to whether you as a services provider can effect the resources for another service provider in a shared hosting situation. This is not possible.

This DOES NOT APPLY here and therefore you are NOT a shared hosting provider

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.