Who handles PCI DSS when an ISV embeds payments on white-label infrastructure?

Security and compliance, including PCI DSS, are handled at platform level by the infrastructure. The ISV or ISO remains responsible for its own systems and how they connect to the platform, but it does not have to build, certify and maintain a card processing environment of its own before its first merchant goes live.

Platform level

On white-label infrastructure, the systems that capture, store and transmit card data belong to the infrastructure provider, which holds its own PCI DSS validation as a service provider. The hosted checkout, the vault, tokenization and provider connections are in the provider's scope. The ISV's systems never see a card number.

What stays with the ISV

• Its own systems and how they connect to the platform: API keys, staff access, the pages that embed the checkout.
• Its own assessment or questionnaire, usually a light one, referencing the provider's attestation.
• Its merchants' validations, if the ISV acts as a PayFac and must track them.

What this avoids

Building, certifying and maintaining a card processing environment before the first merchant goes live: a Level 1 assessment, scans, penetration tests, segmentation, and the engineering to pass them every year. For an ISV, that would be a security team's worth of work unrelated to its product. With the infrastructure provider carrying it, the ISV documents the responsibility split, keeps the provider's attestation on file and validates its own small scope. The responsibility matrix, which PCI DSS requires, should be agreed at contract time.