First, Magento Commerce (Cloud) is PCI certified as a Level 1 Solution Provider, so any merchants using Magento Commerce (Cloud) can use Magento’s PCI Attestation of Compliance to aid their own PCI certification process.

Second, Magento makes PCI compliance easier by offering integrated payment gateways that allow merchants to securely transmit credit card data via direct post API methods or with hosted payment forms provided by the payment gateway and integrated with the merchant’s checkout pages. The Direct Post method allows for information to be sent directly to the payment gateway without sensitive data flowing through or stored on the Magento application server. The Hosted payment forms allow merchants to offer a seamless checkout as well by integrating the payment forms into checkout but with the form hosted by the payment gateway rather than by the Magento application server. By keeping sensitive data outside of the Magento Application server, this enables updates to the core Magento eCommerce application with new marketing, merchandising and content management capabilities, without having to go through PCI compliance re-assessment of the entire Magento eCommerce platform. As a result of these integration options, Magento merchants are able to validate for compliance via self-assessment at the SAQ A or SAQ A-EP level rather than the more difficult SAQ D level.