Does anyone know if authorize.net's SIM rids you of having to be PCI compliant? The payment form is hosted on authorize.net's site and they're processing the payment.
I know you can do a relay response which basically puts some of the transaction details in a url that goes back to your website(to display a receipt). I'm not sure what all information gets put into the url though. I'm wondering if that makes you have to become PCI compliant?
It doesn't necessarily rid you of it but it does reduce your potential exposure. If you handle or store any data covered by PCI DSS standard, and if you use relay response you will, then you have to make sure you meet the portion of the standard that applies to that data.
If you're not storing, transmitting, or otherwise processing card data then you don't have to worry about PCI compliance as you're not doing anything connected to what PCI compliance covers.
If a customer fills out a form and POSTs that data to authnet, the responsibility is on them. If your server is intervening in any way then obviously that's a different story. Unless you're changing the demo API code for SIM/DPM I would bet that you're not intervening.
Authnet will deliver to your server a transaction ID, customer shipping address, etc., along with the card type and last 4 digits, which is all okay for you to store according to PCI documentation.
See this other answer for more links to interesting information on this topic: https://stackoverflow.com/questions/4495496/what-can-i-store-locally-while-still-being-pci-compliant-using-braintree-in-rail
