My organisation acts as a b2b cloud integration platform essentially taking data from one SaaS API and posting it to another.

The data that is moved between the SaaS applications is end user configured, and as such we don't know the content of the messages from day to day. E.g. one customer might be moving order info, another might be moving data regarding new signups to a website. It's possible there is payment card data being transmitted, but without looking we can't guarantee it.

We cache all transactional data for up to 30 days before removing it from our servers.

I'm wondering if there is a "safe harbour" style provision in PCI that works for non payment specific processors. Perhaps for a company similar to DropBox who wouldn't know if an end user uploaded a csv file full of card details. Are DropBox (or a smaller, similar company who offers a free service and don't take card payments themselves) required to get PCI accreditation, just in case?

  • Is your service specifically for payment processors? Do you need some kind of assurance for your customers that you are handling payment data in a PCI-DSS compliant way?
    – schroeder
    Apr 5, 2023 at 13:24
  • @schroeder - No, our service is sector agnostic - in fact I don't think (right now) we have any payment processors as customers, but yes, this question has arisen from a prospect asking if we are PCI-DSS compliant
    – newcube
    Apr 5, 2023 at 14:41
  • So, you don't need to be PCI-DSS compliant, according to PCI. But you can still get it, as explained in the linked answers.
    – schroeder
    Apr 5, 2023 at 14:45
  • @schroeder Thanks for your answers - is there a resource somewhere I can take a look at and use as evidence of the assertion that we don't need PCI? Thanks again
    – newcube
    Apr 5, 2023 at 15:43


You must log in to answer this question.

Browse other questions tagged .