Consider following situation:
- We have location A where we have our online store.
- We have location B where we have payment processing. Server is dedicated to do only payment processing jobs
We can ask for credit card details at server A, and send it via POST to server B - OR - We can ask for credit card details at server B using iframe, and send it via POST to same server - OR - redirect user to payment gateway B, then redirect user back to my site A
- Server A fails vulnerability test
- Server B passes vulnerability test
So basically B is our small payment gateway. And we don't store any card details at any time.
Is it PCI compliant?