Build a Payment Application on force.com that store and process Credit Card Number using different gateway API calls.


Salesforce is a PCI (PCI DSS 3.1) certified service provider.


The Payment Application should opt for PCI DSS or PA DSS ?

Hoping for answer from someone with expertise in both Salesforce/ PaaS and PCI.

1 Answer 1


The answer is PCI DSS.

Since no one answered this question in last two years, I'm answering my question after finding the solution.

The Payment Processing Application that process payments using webservice callout to a PSP and built on SFDC can be PCI compliant.

Also the customer/buyer of this application needed to be PCI compliant too. PCI is a shared responsibility between Salesforce, ISV partner and the application customer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .