Guide
PCI hosting: what a compliant host covers, and what it does not
PCI hosting means a provider whose own environment has been assessed against PCI DSS. That helps. However, hosting with them does not make your application compliant, so the split of duties matters.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What a PCI hosting provider should give you
Ask for two documents before you sign. Therefore you know exactly what is covered. The standard is in the PCI SSC document library.
| Document | Why it matters |
|---|---|
| The host's AOC | Shows its environment was assessed. |
| A responsibility matrix | Shows which requirements each side owns. |
| Service scope | Shows which services the AOC covers. |
Duties that usually stay with you
The matrix varies by provider and service. However, some duties almost always stay with the customer.
- Application security and code changes
- User accounts and access to your systems
- Configuration of your servers or containers
- Logging and review of your application
PCI hosting check
Tick what you have.
Your result appears here as you tick, so you can see what is still open.
Managed versus unmanaged PCI hosting
Managed hosting can shift more duties to the provider, such as patching. Also, it often costs more. So compare the matrix, not just the price.
Checking your PCI hosting provider each year
Requirements 12.8 and 12.9 cover service providers. Therefore keep the host's current AOC on file and confirm its scope annually, because services change.
A short annual check is enough for most merchants. For example, download the new AOC and compare its service list with what you actually use.
Where we help
We review the host's documents and map duties to your controls. However, we are not a QSA, and we do not resell hosting.
Also ask how the host handles incidents that affect your environment. The answer should name who contacts whom and how quickly, because you may need to notify your acquirer. A clear process in the contract saves confusion during a real event, when time matters most.
PCI hosting questions
Does PCI hosting make us compliant?
No. It covers the host's part, while your application and processes remain yours.
What is a responsibility matrix?
A document showing which requirements the host owns and which you own.
Do we need PCI hosting for SAQ A?
Usually not, because card data does not touch your site, but check your setup.
Do you resell hosting?
No. We stay independent.
Related guides
Review your host before you rely on it
Send us your host's documents. We reply in writing with gaps and a budget range. We also flag any duty the matrix leaves unassigned.
Ask us anything