I have a B2B SaaS that my clients then use with their own customers to gather data in a face-to-face scenario with iPads, I would like to expand it to take credit card details. The credit card details would be stored with a PCI compliant third party.
For the processing I could either have the credit card number go through my server (and connect to the third party mentioned above) or use another third party like spreedly.com to do transparent processing (where the credit card number doesn't touch my server at all).
As I'm defined as a service provider, and the volumes are low, then I think the only option is 'SAQ D for service providers'. It seems that is the strictest (and therefore greatest cost) of the SAQs, and that if I had that compliance then I could process the CC data on my servers and even store the CC data if I wanted to.
To me it seems strange I would need the same level of compliance if the CC data never touched my server as if I choose to store the CC data (or at least process it on my server)! So my question is have I got this right or am I missing something?
And apart from that, would my clients need to have some level of PCI compliance, since they would be collecting the CC data? Even though it would all be going through my system and the connected third parties.
Edit: I didn't mention that the money flow ends up in the clients bank not mine, if that makes sense. So I think the client would be responsible for ensuring they used a PCI compliant supplier and also their bank would dictate what compliance they would need to reach separate from me. So I would guess it's wouldn't be my responsibility to ensure the client has PCI compliance, but not sure.