Digital Ocean PCI DSS Server Compliance


I’ve scanned resources regarding this within the DO community, but what level of PCI compliance are the DO servers if any?

I’m currently running a magento store and planning on letting users enter card information on site but process the transaction with 3rd party such as sage or stripe.

Has anyone tackled this before?



Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

I roughly followed this guide:

the droplet passed the PCI Compliance scanner on the first try. In years past (when I was using other hosting) there would always be something that needed fixing or updated, so it was nice to have it pass on the first go.

Moderator update (2021): Our certifications are now available via our Trust Platform at

You can find information on our certifications/compliance for each datacenter here.

Much of PCI-DSS compliance depends on the configuration of your droplet and the services you run on it. We do not provide a hardened image by default but you receive full root access to configure your droplets as you require.

Hello there,

You can see the certificates and we recently changed this page so you can download the certificates you’d need here:

Hope this helps!

The problem that we just ran into is Digital Oceans data center is not PCI compliant. So anything you do on the server will not matter because if you want to get level 1 you need at minimum Digital Ocean to show you an AOC for the Data Center. They cannot do that right now.

Ye i’m planning on using something like stripe.js to handle the bulk of processing payments, i’m just wondering where the server stands in terms of data protection etc.

I just did a PCI compliance test on a droplet. The server itself passed with flying colors (had basic SSH secured, firewall, etc)

Where it did not pass is the loads of documentation they now require. This must be something new because I have passed every year until now.

Things like:

*Are written policies and procedures defined for reviewing the following at least daily, either manually or via log tools? • All security events • Logs of all system components that store, process, or transmit CHD and/or SAD, or that could impact the security of CHD and/or SAD • Logs of all critical system components • Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.)

The amount of documentation required is a bit overwhelming. In the end, the company decided to just stop storing CC numbers rather than pay me to do all the documenting.