I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, as well as payment gateway integration (we use PayPal Checkout). From here, I know that I can proceed with the simplest path for PCI DSS with SAQ A, but it requires me to use PCI DSS compliant service providers. I know that PayPal Checkout is PCI DSS compliant, but my eCommerce SaaS vendor is not. They however use AWS services to host their clients' websites and AWS is PCI DSS compliant.

So is it required to use a PCI DSS compliant eCommerce SaaS vendor? I have been doing lots of reading on this topic but I just can't get a clear answer on this. How does it affect my PCI DSS requirements if the eCommerce SaaS vendor I'm using is not PCI DSS compliant?

  • How many transaction do you make a year? – Jeroen Mar 6 '19 at 9:23
  • It's a completely new website, so we don't know how much exactly we'll make yet. But for the first year, we are planning for a soft launch for the 1st year, so we're pretty sure it's not gonna reach 1 million transaction – lango9631 Mar 6 '19 at 10:01
  • @lango9631: I recently had a similar discussion with a QSA about this for a client of mine. He said that if you don't have more than six million transaction, you could fill out a self-assigned questionnaire (SAQ) and send this to the acquirer. He said that this should be sufficient. Please note that I am NOT a QSA myself. – Jeroen Mar 6 '19 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.