[kulture]

Both documents are interesting. What caught my eye however was the following paragraph

In addition Software as a Service (SaaS) solutions hosted competely at a third party are not within the scope of these mandates, provided that these solutions are hosted by a third party and no such configurations, controls or systems reside on the merchant’s or the agent’s systems. Instead, merchants must use PCI DSS compliant service providers to provide SaaS solutions. PA-DSS compliant payment applications must be used if any such configurations, controls or systems do reside at the merchant or agent location.

Does this mean that you can use XCart without xpayments so long as it is provided as a SERVICE by you host???

p.s. I'm sorry we are way off topic now.