Hope all is well.
I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their account data and the task data is stored on a sever, but there are no issues with that).
They can create, edit, delete, and run these "tasks" that purchase items from E-Commerce stores right when they release to secure copies, and it is generally intended to be used for obtaining limited sneakers right when they release. So, their billing data, which is stored locally, is in JSON format and encrypted using our own keys. It will get sent to a server, running an instance of a task execution system we've setup on several of its ports. When a task is ran, it will search for one of these ports that isn't in use, and send the package of data so the script can run and purchase the product(s). This package of data contains the billing info JSON, which is decrypted upon arrival at the server, and some plaintext data (such as what size of shoe or what shoe color).
The server has an SSL and other basic security practices in place, but I do fear the complicated PCI standards inhibiting this project. So, that leaves me with two questions:
1) It looks like the amount of money you need to pay for compliance varies on your number of servers. If I have several ports on one server transmitting the billing data, do I need to get all of those ports assessed and pay for all of that, or just the one server that is hosting all of them?
2) Can I do this without complying to any of these standards? And if not, is there any good way to estimate would the price range would be per server?
Thanks so much for your time.