Does your company share cardholder data with any third-party service providers (for example, Yes gateways, payment processors, payment service providers (PSP), web-hosting companies, No airline booking agents, loyalty program agents, etc.)? If Yes: Name of service provider: Description of services provided: Note: Requirement 12.8 applies to all entities in this list. Part 2g. Eligibility to Complete SAQ A-EP Merchant certifies eligibility to complete this shortened version of the Self-Assessment Questionnaire because, for this payment channel: Merchant accepts only e-commerce transactions; All processing of cardholder data is outsourced to a PCI DSS validated third-party payment processor; Merchant’s e-commerce website does not receive cardholder data but controls how consumers, or cardholder data, are redirected to a PCI DSS validated third-party payment processor; Merchant’s e-commerce website is not connected to any other systems within merchant’s environment (this can be achieved via network segmentation to isolate the website from all other systems); If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g., including PCI DSS Appendix A if the provider is a shared hosting provider); All elements of payment that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS compliant service provider(s); Merchant does not electronically store, process, or transmit any cardholder data on merchant systems or premises, but relies entirely on a third party(s) to handle all these functions; Merchant has confirmed that all third party(s) handling storage, processing, and/or transmission of cardholder data are PCI DSS compliant; and Merchant retains only paper reports or receipts with cardholder data, and these documents are not received electronically.
Does your company share cardholder data with any third-party service providers (for example, gateways, payment processors, payment service providers (PSP), web-hosting companies, airline booking agents, loyalty program agents, etc.)? Yes No If Yes: Name of service provider: Description of services provided: Note: Requirement 12.8 applies to all entities in this list. Part 2g. Eligibility to Complete SAQ A-EP Merchant certifies eligibility to complete this shortened version of the Self-Assessment Questionnaire because, for this payment channel: Merchant accepts only e-commerce transactions; All processing of cardholder data is outsourced to a PCI DSS validated third-party payment processor; Merchant’s e-commerce website does not receive cardholder data but controls how consumers, or cardholder data, are redirected to a PCI DSS validated third-party payment processor; Merchant’s e-commerce website is not connected to any other systems within merchant’s environment (this can be achieved via network segmentation to isolate the website from all other systems); If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g., including PCI DSS Appendix A if the provider is a shared hosting provider); All elements of payment that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS compliant service provider(s); Merchant does not electronically store, process, or transmit any cardholder data on merchant systems or premises, but relies entirely on a third party(s) to handle all these functions; Merchant has confirmed that all third party(s) handling storage, processing, and/or transmission of cardholder data are PCI DSS compliant; and Merchant retains only paper reports or receipts with cardholder data, and these documents are not received electronically.