Are we a shared hosting/service provider?
The PCI SSC defines what they mean by "shared hosting provider" under the PCI DSS requirement 2.6. The guidance section states:
This [requirement] is intended for hosting providers that provide shared hosting environments for multiple clients on the same server. When all data is on the same server and under control of a single environment, often the settings on these shared servers are not manageable by individual clients. This allows clients to add insecure functions and scripts that impact the security of all other client environments; and thereby make it easy for a malicious individual to compromise one client's data and thereby gain access to all other clients' data. See Appendix A1 for details of requirements.
From your description, you probably are a shared hosting provider but its not clear whether multiple unrelated clients are accessing and storing data on a common set of servers, e.g. 12 clients accessing or running separate instances of your web application one a single web server.
This is exactly how my company operates and we are evaluated for PCI compliance as a shared hosting provider. We have multiple physical servers that run multiple virtual servers on each physical server. While some clients pay for ftp access, that is sand-boxed and will be replaced by a new mechanism within the year. Uploaded files are highly restricted by type, scanned by antivirus, and more. Databases are separate but on shared SQL server instances. In one component, a DB that is considered ours and not the clients' has client data mixed with other client data but essentially every record has a unique key, so only that component knows how decode that client's data for that client.
If this weren't allowed, even PayPal couldn't function because they would need a separate physical server for every merchant client.
The referenced Appendix A1 contains 4 specific sub-requirements, summarized:
A1 - Protect each entity's hosted environment and data, per A1.1 - A1.4
A1.1 - Ensure that each entity only runs processes that have access to that entity’s cardholder data environment.
A1.2 Restrict each entity’s access and privileges to its own cardholder data environment only.
A1.3 Ensure logging and audit trails are enabled and unique to each entity’s cardholder data environment and consistent with PCI DSS Requirement 10.
A1.4 Enable processes to provide for timely forensic investigation in the event of a compromise to any hosted merchant or service provider.
The latter 2 can be the toughest, depending on how your logging and forensic data are done.