PCI DSS Data Center: Our v4.0.1 Attestation of Compliance explained
A PCI DSS data center hosts payment systems within an assessed physical environment. This assessment follows the Payment Card Industry Data Security Standard (PCI DSS). This standard is issued by the PCI Security Standards Council (PCI SSC). For its colocation hosting, Thésée Datacenter holds a PCI DSS v4.0.1 Attestation of Compliance. This attestation is part of our secure data center approach.
What our PCI DSS data center attestation proves
The AOC (Attestation of Compliance) summarizes the assessment. It specifies the sites, the assessed service, the tested requirements, and the status achieved.
By definition, this assessment remains partial. It only covers the requirements related to physical hosting. Your systems are subject to the other requirements, which fall outside our scope.
Why host your payment environment in a PCI DSS data center
- An already assessed scope: our attestation serves as support for your assessor regarding the physical security of the hosting.
- Controlled access: the QSA tests access to the sites and rooms within the defined scope.
- A resilient infrastructure: the Aubergenville campus (TDC01) holds the Tier IV Constructed Facility certification from the Uptime Institute
- Hosting under French law: our two sites are located in the Yvelines, in Île-de-France.
SAQ, AOC, QSA: reading a PCI DSS file without making mistakes
- SAQ (Self-Assessment Questionnaire): this self-assessment questionnaire is available in version D for service providers.
- AOC: this signed attestation presents the compliance status and the results obtained.
- QSA: this assessor, qualified by the PCI SSC, conducts the testing procedures for our attestation.
- ROC (Report on Compliance): this detailed report follows a complete assessment.
No organization issues a PCI DSS data center 'certification'. Every year, the entity validates its compliance via an SAQ or a ROC, summarized in an AOC.
Who does what: the division of responsibilities in your payment environment
Our clients retain responsibility for card data. Thésée Datacenter provides the physical environment and manages access to the sites. This table details the breakdown by requirement.
Your assessor requires this breakdown, as well as our attestation. Requirement 12.8 mandates the monitoring of your service providers.
PCI DSS v4.0.1: Key dates for your compliance
- June 11, 2024: The PCI SSC published version 4.0.1 as a limited revision with no new requirements.
- December 31, 2024: The PCI SSC retires version 4.0; v4.0.1 then becomes the only active version.
- March 31, 2025: The new future-dated requirements become mandatory.
- Annually: the entity re-validates its compliance.
The PCI SSC provides free access to the complete standard and questionnaires in its document library.
View our PCI DSS Attestation of Compliance.
Does your assessor require the complete breakdown of responsibilities? Contact our team.
See also: ISO 27001 Data Center · ISO 50001 Data Center · Our colocation offers
Frequently asked questions about PCI DSS compliance
Find answers to the most frequently asked questions about PCI DSS, the scope of our attestation, and its renewal.
Can a data center be PCI DSS certified?
Not exactly. The PCI SSC does not issue certificates. A data center proves its compliance through an annual attestation, resulting from an SAQ or a ROC.
Where can I download the PCI DSS v4.0.1 PDF?
"The PCI SSC makes the standard available for free in its document library, upon acceptance of a license agreement. The SAQ questionnaires and attestation templates can also be found there.
What is an SAQ D for service providers?
This is the self-assessment questionnaire for service providers. It covers the requirements of the standard and leads to an attestation of compliance. For our attestation, a QSA conducted the testing procedures.
Is hosting my servers at Thésée Datacenter enough to be PCI DSS compliant?
No. Our attestation covers physical hosting. You validate the compliance of your systems, your applications, and your payment processes.
Does a PCI DSS attestation need to be renewed?
Yes, compliance validation is renewed annually. Always ask your hosting provider for the most recent attestation.