[happyscott]

I have just spoken to Sagepay who tell me that because we use vspform it is they who have to be pci compliant and not our site.

However because I also take payments via the phone I have to have a 'certificate'.

Looking more into this but if this is correct then that's really good news as am currently looking for an alternative shopping cart in fear that x-cart will not be ready in time.