We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive card details in a database, physical media etc etc. We've passed numerous PCI scans.
Our payment flow is as follows:
- Add items to basket.
- Enter address details.
- Move to new page, hosted on our own website (which itself is generated by a dedicated server, hosted at a PCI compliant data centre) where the customer enters their card details.
- These details are then HTTPS POSTed to our server where they are assigned to a variable and then cURL Posted (with SSL) to our 3rd Party Payment processor.
I'm hoping that because card details are held in volatile RAM rather than any permanent storage we may still fall under SAQ A. If we do not, (and only considering the above criteria) would we fall under SAQ C or SAQ D? I've previously been advised SAQ C but this seems to be reserved specifically for hardware payment applications, which we don't use.