PCI-compliant hosting: what it is and when you need it

Key takeaways

• PCI compliant-ready hosting provides a secure infrastructure foundation for businesses that store, process, or transmit credit card data, but it doesn’t make your business automatically compliant.
• Compliance follows a shared responsibility model. Your hosting provider secures the infrastructure, while your team stays accountable for applications, access controls, and business processes.
• Your hosting architecture, whether multi-tenant, dedicated, or isolated cloud, directly determines your PCI scope, not just your security posture.

PCI DSS sets 12 requirements for any business that handles card data, and PCI compliant hosting takes care of some of them but not all. Here’s what a host covers, what stays with your team, and why the hosting setup you choose is important. 

What is PCI compliant hosting?

PCI compliant hosting is a hosting environment built to meet the security requirements set by the Payment Card Industry Data Security Standard (PCI DSS) for businesses that handle cardholder data.

Note that a PCI-compliant host gives you an environment that’s configured to support compliance. It doesn’t certify your business as compliant. Think of it like renting a store in a mall. Mall security takes care of the building, but they don’t lock your register, recover keys from a former employee, or fill out your annual inspections.

PCI DSS applies any time your systems store, process, or transmit credit card data. If that describes your setup, the standard is already in play, and your hosting environment is one piece of meeting it.

Key components of PCI compliant hosting

A hosting environment built for PCI covers four key components, and they map closely to what PCI DSS asks for.

1. Network security

Network security includes firewalls at the perimeter, intrusion detection watching for anomalies, and network segmentation that isolates the cardholder data environment (CDE) from the rest of your infrastructure. Segmentation keeps your sensitive systems from sharing server space with everything else you run.

2. Data encryption

Data encryption protects cardholder data in two states:

• In transit: TLS secures data as it moves across networks. 
• At rest: Disk-level encryption and protected backups ensure stored data is protected.

3. Access control

Access control keeps the number of people who can reach sensitive systems small and accountable. Unique user IDs, role-based permissions, and multi-factor authentication on administrative access are the baseline. 

4. Monitoring

Monitoring and testing is the ongoing layer. Logging captures who did what and when. Approved Scanning Vendor (ASV) scans and penetration testing check for exposure on a schedule. SIEM integration pulls those signals into one place so a problem gets noticed while it’s still small.

The shared responsibility model

PCI compliance is a shared responsibility model. Your hosting provider covers the infrastructure layer: physical security of the data center, network hardware, the firewalls and patching they manage, and monitoring at the infrastructure level. You cover everything on top of that: your application code, software updates, access policies, how your team handles cardholder data, completing the right Self-Assessment Questionnaire (SAQ), and training your staff.

Goal	PCI DSS requirements	Your host’s responsibility	Your responsibility
Keep the network secure	1, 2	Network infrastructure and hardware, infrastructure firewalls, secure configurations, and patching	Secure configuration of anything you manage on top of the infrastructure
Protect the card data itself	3, 4	Encryption in transit (4) at the infrastructure level	How you store, handle, and protect cardholder data (3)
Keep software up to date	5, 6	Malware protection at the infrastructure level	Application and website code, plus patching your own site, plugins, and software
Control who has access	7, 8, 9	Physical data center security (9)	Access policies and user management: limit access to those who need it (7), and give each person a unique login (8)
Watch and test	10, 11	Infrastructure-level monitoring and logging (10), and often ASV scans and pen tests (11)	Reviewing logs and acting on scan and test findings for your own systems. This goal is shared.
Write it down and train your team	12	Documented infrastructure controls (AOC, SOC 2)	SAQ or ROC completion, security policies, and staff training

Most merchants who run into trouble assumed their hosting provider was covering something that was their responsibility.

When do you need PCI compliant hosting?

You need PCI compliant hosting if credit card data touches your servers.

No: If you use a fully hosted checkout like Stripe, PayPal, or Square, where card data is captured on the provider’s pages, your hosting environment sits outside PCI scope. A specialized PCI host may be more than you need.

Yes: If you host your own payment forms, store card numbers, or run a custom payment flow, card data is moving through your environment, and PCI compliant hosting is part of meeting the requirement.

PCI compliance levels and what they mean for hosting requirements

There are four PCI DSS compliance levels based on annual transaction volume. Your level decides how you have to prove compliance.

Level	Transaction volume (annual)	How you validate	Typical profile
1	Over 6 million	QSA audit and Report on Compliance (ROC), plus ASV scans	Large retailers, high-volume processors
2	1 million to 6 million	SAQ (ROC in some cases), plus ASV scans	Established mid-size merchants
3	20,000 to 1 million ecommerce	SAQ, plus ASV scans	Growing online stores
4	Fewer than 20,000 ecommerce	SAQ, plus ASV scans (often recommended)	Small and newer merchants

Thresholds vary slightly by card brand, but more volume means more validation requirements. Level 1 merchants face an annual audit from a Qualified Security Assessor. Everyone else self-assesses with the right SAQ and runs scans.

For a fuller breakdown, see PCI compliance levels explained.

12 PCI DSS requirements

PCI DSS 4.0 went into effect in 2025, and outlines 12 requirements. 

Your host can support, and in a managed environment often handles, the infrastructure-leaning requirements: maintaining network security controls and firewalls (1), applying secure configurations (2), encrypting data in transit (4), protecting systems from malware at the infrastructure level (5), restricting physical access to the data center (9), and logging and monitoring access (10). Testing security regularly (11) is usually shared, since ASV scans and pen tests often run through the host.

You still own the requirements tied to your business and your application: protecting stored account data the way you handle it (3), keeping your own systems and software secure (6), restricting access by business need to know (7), authenticating your users (8), and maintaining the security policies and staff training that hold it all together (12).

That split is the shared responsibility model in practice, and it means your hosting environment is important. 

How your hosting environment affects PCI scope

Your hosting environment affects PCI scope because of the security options available for different types of hosting.

Shared hosting expands your scope and your risk. You’re sitting alongside other tenants whose configurations you don’t control, your segmentation is murkier, and your cardholder data environment ends up larger and harder to document cleanly. 

A dedicated or isolated cloud environment does the opposite. You get a smaller CDE footprint, clean segmentation between your sensitive systems and everything else, and audit documentation that’s easier to produce because boundaries are clear. When your CDE is tightly drawn, your assessment gets simpler.

A managed environment adds another layer of relief. Managed firewalls, a web application firewall, intrusion detection, and centralized logging move real operational work off your team and onto infrastructure that’s already built for it.

The takeaway: choosing your hosting is an infrastructure-level compliance decision, not just a preference about performance or price. It sets the size of the problem you have to solve.

What to look for in a PCI compliant hosting provider

Here’s what to ask PCI compliant hosting providers: 

Can we see your PCI DSS Attestation of Compliance (AOC) and a current SOC 2 report? A provider that’s serious about compliance will have both ready, and an AOC tells you exactly what their infrastructure covers.

How does monitoring and incident response work? You want 24/7 monitoring and a clear protocol for what happens when something fires at 2 a.m.

Who controls the encryption keys? The answer shapes your level of responsibility.

How are logs are retained and do they integrate with our SIEM? Logging you can’t access or correlate doesn’t help during an assessment or an investigation.

What’s the escalation process when something goes wrong? The time to learn how a provider handles a problem is before you have one.

What level of isolation do you offer? Dedicated or single-tenant environments keep other customers off your hardware, which can shrink your PCI scope.

This is vendor due diligence, the same discipline regulated industries apply to any provider that touches sensitive data. The provider conversation is part of your compliance program, so treat it like one.

The cost of PCI compliance

For smaller merchants, the cost of PCI compliance runs between $1,000-$10,000 a year. That covers the hosting environment, ASV scans, and managing the SAQ process. Your cost depends on your level, architecture, and how much of the work your host absorbs versus how much your team handles.

Level 1 costs more. A QSA audit, the resulting Report on Compliance, and required penetration testing push the figure well above the small-merchant range.

Non-compliance means fines, penalties from the card brands, and in serious cases, losing the ability to process payments at all. 

Staying compliant over time

Compliance is a state you maintain over time.

Your scope changes as your systems change. Add a new payment integration, spin up a new server, or change how you handle data, and your CDE shifts with it, which means reassessing regularly. 

Staff training carries weight, too. Most incidents involve a person, not just a system. And your re-validation requirements depend on your level, so build the right cadence into your calendar.

Next steps for PCI-compliant hosting

Your next step toward PCI-compliant hosting is to map where card data flows through your setup and which systems it touches. Once you know that, the right hosting architecture, and how much PCI work you can hand off, gets easier to decide.

If you’d rather not sort that out alone, Nexcess builds dedicated and isolated environments designed to keep your cardholder data environment and audit documentation clean, with managed firewalls, monitoring, and logging handled for you.