Shared web host says they are not a service provider and have no attestation of compliance or SAQ. But they say they are PCI compliant.
According to SAQ, it would seem like I couldn't be compliant on their hosting:
- If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g., including PCI DSS Appendix A if the provider is a shared hosting provider);
- All elements of payment pages that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS compliant service provider(s);
This is very surprising since they are a fairly large US host specifically saying they are pci compliant.
Can I be compliant on their hosting?