PCI compliant hosting: what a web host can cover, and what it cannot

PCI DSS compliant hosting, row by row

Each row is a question PCI DSS makes you answer about a host, with the requirement it maps to. “Ask the vendor” means the host's own pages did not say when we read them on 2026-10-28.

The split runs down the middle. The three clouds state their own validation and publish the paperwork; the three managed hosts sell a looked-after server and leave the PCI DSS proof to you. Neither half is wrong. Which one you need is the next section.

PCI compliant server or hosted checkout: which you need

The questionnaire you file is set by how your checkout takes the card, and the questionnaire decides how much the host matters. If any element of the payment page delivered to the shopper's browser comes from the merchant's own website, SAQ A does not apply; SAQ A-EP may. If card numbers reach your server, the Council's table points to SAQ D. Pick your setup:

Not sure which setup your store runs? The payment gateways compared page shows each gateway's routes, and the SAQ type finder names the form. A store that must stay on the long form will find the full list in the SAQ D guide.

What a PCI badge on a host's page can mean

“PCI compliant web hosting” is a phrase anyone can print. Read the exact words, because four hosts we read on the same day used them to mean four different things.

DigitalOcean's line is the one to read twice. Its certification page says it “maintains a Zero-Footprint data policy by way of our PCI-DSS SAQ-A validation. Through our attestation, DigitalOcean commits to not storing, processing, or transmitting cardholder data within our administrative environment.” SAQ A is a merchant's form, and DigitalOcean applies it to its own administrative systems. The same page lists PCI-DSS among the certifications of its colocated data centers, which covers the buildings, not your server (DigitalOcean's certification reports). That is why DigitalOcean has no column here: none of its pages we read describe a PCI DSS assessment of the servers it rents out. If you host with it, ask it directly before card data goes anywhere near a droplet.

One date to check on every badge: Microsoft's Azure page still says Azure is compliant “under PCI DSS version 4.0,” while v4.0.1 is the version in force. Ask which version the AOC you download covers.

Shared servers: the rules for a multi-tenant host

Cheap hosting puts many customers on one machine. PCI DSS has an appendix for exactly that, Appendix A1, written for “multi-tenant service providers.” It binds the host in its own assessment, not you, but it tells you what to look for when card data might sit on a shared server:

• The host keeps every customer's environment and data protected and apart from the others (A1.1), and the separation is confirmed “at least once every six months via penetration testing” (A1.1.4).
• “Multi-tenant service providers facilitate logging and incident response for all customers” (A1.2): your logs, readable only by you, and a way to investigate if something goes wrong.

If a shared plan's host cannot show an AOC that covers that appendix, keep card data off it. That is the usual reason small shops move to a hosted payment page instead: the SAQ A guide shows how a redirect or an iframe keeps card numbers away from any server you rent.

What stays yours on any host

“The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” Every host in the table says a version of the same thing. Where they differ is how far up the stack their half goes. AWS: the customer “assumes responsibility and management of the guest operating system (including updates and security patches)” (AWS shared responsibility model). Microsoft, for a virtual machine: “You manage virtual machines, operating systems, and applications” (Microsoft Learn). Kinsta, a managed host, keeps “operating system patches up to date” and leaves “everything above the infrastructure layer” to you (Kinsta's PCI article).

Two jobs never move to the host. The quarterly external scan is yours to arrange: scan customers are responsible for “Selecting an ASV from the list of Approved Scanning Vendors,” and the ASV scanning vendors compared page lists who can run it. And the firewall in front of a public site: Requirement 6.4.2 asks for “an automated technical solution” that “continually detects and prevents web-based attacks.” Every host here offers one, but on the clouds it is a service you switch on and configure. The PCI firewall guide covers the network side.

And four pieces of paperwork, whichever host you pick:

1. 01Put the host on your list of service providers, with what it does for you. Req. 12.8.1
2. 02Keep a written agreement in which the host acknowledges its part in account-data security. Req. 12.8.2
3. 03Check its PCI DSS status at least once every 12 months. Req. 12.8.4
4. 04Keep its split of which requirements are its, yours, or shared. Req. 12.8.5

A host that is a service provider owes you the material for the last two: Requirement 12.9.2 has it provide “PCI DSS compliance status information” and its split of responsibilities “upon customer request.” The Attestation of Compliance guide shows what to check on the AOC it sends.

Each PCI DSS hosting provider up close

PCI hosting: questions merchants ask