Does anyone know if authorize.net's SIM rids you of having to be PCI compliant? The payment form is hosted on authorize.net's site and they're processing the payment.

I know you can do a relay response which basically puts some of the transaction details in a url that goes back to your website(to display a receipt). I'm not sure what all information gets put into the url though. I'm wondering if that makes you have to become PCI compliant?

2 Answers 2


It doesn't necessarily rid you of it but it does reduce your potential exposure. If you handle or store any data covered by PCI DSS standard, and if you use relay response you will, then you have to make sure you meet the portion of the standard that applies to that data.

  • do you know what standards i will need to meet to use the relay response? I'm trying to code something that does a certain thing depending on the success of the transaction but i can't afford $3k/month for PCI compliant web hosting and the slew of other stuff you need to be PCI compliant
    – David
    Commented Jul 19, 2011 at 14:48
  • It doesn't take $3000 a month to meet the requirements when you're just doing SIM. It's mostly having some policies and procedures in place, having good logging and keeping your server up to date. As for hosting, Amazon EC2 is PCI certified, a micro instance would cost you $14.40 per month. Commented Jul 20, 2011 at 4:33

If you're not storing, transmitting, or otherwise processing card data then you don't have to worry about PCI compliance as you're not doing anything connected to what PCI compliance covers.

If a customer fills out a form and POSTs that data to authnet, the responsibility is on them. If your server is intervening in any way then obviously that's a different story. Unless you're changing the demo API code for SIM/DPM I would bet that you're not intervening.

Authnet will deliver to your server a transaction ID, customer shipping address, etc., along with the card type and last 4 digits, which is all okay for you to store according to PCI documentation.

See this other answer for more links to interesting information on this topic: https://stackoverflow.com/questions/4495496/what-can-i-store-locally-while-still-being-pci-compliant-using-braintree-in-rail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.