We are not responsible for any unauthorized access to, alteration of, or the deletion, destruction, damage, loss or failure to store any of, Your Content (as defined in Section 10.2), your Applications, or other data which you submit or use in connection with your account or the Services.

Hi,

Thank you for contacting Amazon Web Services. Our payment system is PCI compliant and it is an “alternative payment processing service” meaning your users re-direct to our platform to conduct the payment event using their credit cards or bank accounts. The benefit for you is that we handle all the sensitive customer data so you don’t have to. If you haven’t looked at it, I highly suggest you check out the features and functions of our Flexible Payment Service and our Payment Widgets ( http://aws.amazon.com/fps).

As for PCI level 2 compliance, that requires external scanning via a 3rd party, PCI-approved vendor. It is possible for you to build a PCI level 2 compliant app in our AWS cloud using EC2 and S3, but you cannot achieve level 1 compliance. And you have to provide the appropriate encryption mechanisms and key management processes. If you have a data breach, you automatically need to become level 1 compliant which requires on-site auditing; that is something we cannot extend to our customers. This seems like a risk that could challenge your business; as a best practice, I recommend businesses always plan for level 1 compliance. So, from a compliance and risk management perspective, we recommend that you do not store sensitive credit card payment information in our EC2/S3 system because it is not inherently PCI level 1 compliant. It is quite feasible for you to run your entire app in our cloud but keep the credit card data stored on your own local servers which are available for auditing, scanning, and on-site review at any time.

Regards,

Cindy S.
Amazon Web Services
http://aws.amazon.com

Hmm, interesting exchange.

Amazon clearly states you CAN be PCI compliant on their system within the thread, yet somehow everyone ignore this. This is worth highlighting rather than downplaying.

You can NOT be PCI level ONE compliant - but this really only applies to banks and MAJOR retailers.

If you are that big, it is a completely different ballgame. Put this way - you will be spending $40,000+ just to be assessed for PCI compliance.

Most of us will be screwed if that happens, anyway. The Amazon data center matches all PCI requirements - the main problem is your PCI assesor can not visit it - but this is only required for the highest level - which most of us don't need.

You still need to lock down your own server and match all the procedures - but the good news is that YES, you can become properly PCI compliant on these servers at much lower cost than anywhere else.

As to having to move servers in the case of having a break-in, that is at that stage your smallest problem. After all PCI compliance of your Database center is only half of the compliance anyway.

So you basically want to get the most affordable way to become PCI compliant you can get and make sure no one can get card details from your system in which ever way you want, within the regulations.

After all PCI complaince does not only kick in if you store credit cards. Just using an open source e-commerce solution which conntects to a payment gateway in the background via an API requires PCI compliance, as it transfers credit card details without storing it.

So this thread is great news.
:)