We provide a shopping cart service with integrations to multiple third party payment processors (PayPal, Authorize.net, etc.) where all payment processing happens on their networks (i.e., no CC data enters our networks). Some of our prospects have said that we're a Service Provider in their eyes since we control the redirect to the payment processors.
Since we have no CDE, can we response "N/A" to all SAQ-D SP requirements that reference the CDE?
I'm trying to narrow down our scope which I think is just the server that performs the redirect. However since it neither stores, processes nor transmits CC data, I'm having trouble figuring how we fit within SAQ-D SP.
I'm sure we'll need a QSA at some point but I'd like to figure out as much as possible so I can at least have an intelligent conversation and a list of questions before contracting with them.