Digital Ocean PCI DSS Server Compliance

I roughly followed this guide: http://bodhizazen.net/Tutorials/SSH_security

the droplet passed the PCI Compliance scanner on the first try. In years past (when I was using other hosting) there would always be something that needed fixing or updated, so it was nice to have it pass on the first go.

You can find information on our certifications/compliance for each datacenter here.

Much of PCI-DSS compliance depends on the configuration of your droplet and the services you run on it. We do not provide a hardened image by default but you receive full root access to configure your droplets as you require.

Hello there,

You can see the certificates and we recently changed this page so you can download the certificates you’d need here:

https://www.digitalocean.com/trust/certification-reports

Hope this helps!

The problem that we just ran into is Digital Oceans data center is not PCI compliant. So anything you do on the server will not matter because if you want to get level 1 you need at minimum Digital Ocean to show you an AOC for the Data Center. They cannot do that right now.

Ye i’m planning on using something like stripe.js to handle the bulk of processing payments, i’m just wondering where the server stands in terms of data protection etc.

I just did a PCI compliance test on a droplet. The server itself passed with flying colors (had basic SSH secured, firewall, etc)

Where it did not pass is the loads of documentation they now require. This must be something new because I have passed every year until now.

Things like:

*Are written policies and procedures defined for reviewing the following at least daily, either manually or via log tools? • All security events • Logs of all system components that store, process, or transmit CHD and/or SAD, or that could impact the security of CHD and/or SAD • Logs of all critical system components • Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.)

The amount of documentation required is a bit overwhelming. In the end, the company decided to just stop storing CC numbers rather than pay me to do all the documenting.