You seem to be A-EP You seem to be A, based on the specific products referenced, but you should ask your processor(s) to be sure.
Amazon Payments "Login and Pay" is jut a button that takes the processors site, and the entire payment is carried out on the processors site, so technically there are no "elements of the payment page (that) originate from the merchant website" - the payment page is all on Amazon, none on your site. So that should also be SAQ A, although it would be really nice if Amazon put this in their FAQ.
Or - in short - if this is confusing to you, it's because it's confusing. Again, best to ask your processor. They're supposed to know better.
If by "Stripe Checkout widget" you mean Checkout, then you're SAQ A-EP, because "elements of the payment page originate from the merchant website."
would only seem to be SAQ A because all your checkout forms were hosted by the processors and your customers were directed to them before checkout or via an iframe .
The key distinction here is found in page iii of the SAQ A:
The entirety of all payment pages delivered to the consumer’s browser originates directly from a third-party PCI DSS validated service provider(s)
The full set of expectations for a SAQ A merchant to meet are as follows:
SAQ A merchants may be either e-commerce or mail/telephone-order merchants (card-not-present), and do not store, process, or transmit any cardholder data in electronic format on their systems or premises.
SAQ A merchants confirm that, for this payment channel:
- Your company accepts only card-not-present (e-commerce or mail/telephone-order) transactions;
- All payment acceptance and processing are entirely outsourced to PCI DSS validated third-party service providers;
- Your company has no direct control of the manner in which cardholder data is captured, processed, transmitted, or stored;
- Your company does not electronically store, process, or transmit any cardholder data on your systems or premises, but relies entirely
on a third party(s) to handle all these functions;
- Your company has confirmed that all third party(s) handling acceptance, storage, processing, and/or transmission of cardholder
data are PCI DSS compliant; and
- Your company retains only paper reports or receipts with cardholder data, and these documents are not received electronically.
Additionally, for e-commerce channels:
- The entirety of all payment pages delivered to the consumer’s browser originates directly from a third-party PCI DSS validated