My organisation acts as a b2b cloud integration platform essentially taking data from one SaaS API and posting it to another.
The data that is moved between the SaaS applications is end user configured, and as such we don't know the content of the messages from day to day. E.g. one customer might be moving order info, another might be moving data regarding new signups to a website. It's possible there is payment card data being transmitted, but without looking we can't guarantee it.
We cache all transactional data for up to 30 days before removing it from our servers.
I'm wondering if there is a "safe harbour" style provision in PCI that works for non payment specific processors. Perhaps for a company similar to DropBox who wouldn't know if an end user uploaded a csv file full of card details. Are DropBox (or a smaller, similar company who offers a free service and don't take card payments themselves) required to get PCI accreditation, just in case?
