PCI Hosting Solutions

PCI Hosting Solutions

Reach New Levels of Performance and Scalability

Get Started with Our One Month Free Offer

Trusted By Over 15,000 Businesses

Our Clients

Start Your PCI Project with a One Month Free Service!

PCI Ready Compute & Storage, Encrypted VPN, Security Firewall, Offsite Backups, Disaster Recovery, & More!

One Month Free Offer

Looking for PCI Compliant Hosting?

We Can Help with a Free Assessment.

  • IT Architecture Design, Security, & Guidance.
  • Flexible Private, Public, & Hybrid Hosting.
  • 24x7x365 Security, Support, & Monitoring.
Contact Us Now!
Stevie Gold Award Med Tech Award

SOC Audit HIPAA Audit HITECH Audit

HIPAA Partners

PCI-Hosting

PCI Hosting Solutions

If your company requires PCI-DSS compliance, Atlantic.Net's managed security and compliance services coupled with our award-winning Cloud Platform will provide you and your team the easy button to help achieve and exceed your credit card industry requirements! With our expanded network capacity and hardened data centers, your business will be able to achieve the uptime, cyber-security requirements, and meet your customers' needs while reducing your overall cost. Gain the competitive advantage you need with ease with our PCI Compliant Hosting and bring focus to your core business.

Pci compliant Pci Features

Atlantic.Net PCI Hosting Features:

  • Managed Firewall
  • Fully Encrypted Backups
  • SOC 2, SOC 3, and HIPAA Audited
  • User and Point to Point Encrypted VPN
  • Managed Intrusion Prevention System
  • ACP OnSite and Offsite Backup and Replication
  • WAF, CDN, and DDoS protection via Network Edge Protection
  • Disk Encryption (standard) for all Cloud Hosts and VMs

PCI Hosting Plans

If your business accepts credit card payments, we’ve got you covered with PCI compliant cloud hosting. You can focus on running your business knowing your cloud VPS is securely and properly handling your customers’ sensitive credit card information when passing through credit card payments on your website or app. All Atlantic.Net PCI compliant hosting packages listed below have been specially designed to provide more for less and help you attain PCI compliance affordably.

Plan Name PCI Cloud I PCI Cloud II PCI Cloud III PCI Dedicated I PCI Dedicated I PCI Dedicated III
Server Type Cloud Cloud Cloud Dedicated - SATA Dedicated - NVMe Dedicated - NVMe
Processor 4 vCPUs 12 vCPUs 20 vCPUs 12 vCPUs 40 vCPUs 64 Cores
Memory 16 GB 64 GB 128 GB 64 GB 256 GB 1536 GB
Storage 100 GB 500 GB 1000 GB 480 GB 4800 GB 19200 GB
Data Transfer 10 TB 10 TB 10 TB 10 TB 10 TB 10 TB
Managed Security Firewall
Intrusion Prevention Service
5 VPN Licenses
Network Security
Server Management
Onsite Daily Backups
Offsite Daily Bakcups
Encrypted Data At Rest
Anti-Malware
Log Inspection
System Security w/ File integrity
Monthly Cost $416.89 $594.24 $823.43 $717.62 $2,061.62 $6,872.62

Optional

Network Edge Protection CDN/WAF

*Pricing based on 36 month term

*cPanel licensing cost starts at $16 per month

*All plans are available in every location for Managed Server clients.

*Anti-Malware, Network Security, and System Security with Trend Micro Deep Security Suite

Our Managed Services are versatile and extensive, including diverse services in the areas of Managed Security, Managed Storage Services, OS Management Services, and Managed Network Services. These services can be tailored to your particular requirements. If you include any of these high-touch, “white glove” services with your Atlantic.Net Hosting solution, you will have a team of certified and expert engineers at your service, performing double-duty in real-time monitoring and consultative capacities.

Full line of hosting services to provide a turnkey hosting solution!

Cloud Hosting

Cloud Hosting

Atlantic.Net provides secure Cloud Hosting in our agile virtual environment, supporting a variety of e-commerce platforms. Our storage, memory, and compute-optimized platform will boost the performance of your online applications and network connectivity, while 100% uptime will ensure your online retail store remains live, searchable, and relevant, building customer trust. The benefit in hosting your application virtually is that it is fast and easy to adjust your storage needs depending on traffic and usage, keeping your investment budget-friendly.

Dedicated Hosting

Dedicated Hosting

Boosting and supporting high traffic websites and high activity grids is our specialty. The robustness, high security, and meeting of the strictest compliance standards of our Dedicated Hosting environment ensure your data will remain safeguarded and its transfer seamless. Designed to handle massive amounts of data at lightening speeds, our servers feature enterprise-grade solid state drives. Our extensive networks are backed by redundant high-speed connections ensuring you’re always online. To maximize your investment, we offer a plethora of plans to fit any business website, small or large, with the aim to elevate its online retailing.

Compliant Hosting

Compliant Hosting

Our data centers were built to fulfill the strictest requirements, eliminating regulations concerns. Our data centers are routinely inspected. We are SOC 2 TYPE II and SOC 3 TYPE II certified to ensure that we are up to the exacting standards to secure the most sensitive data. Leave the monitoring of changes to us, as you focus on growing your business.

PCI Compliance Simplified!

Our turnkey PCI ready hosting solution, backed by over 24 years of experience ensures that you gain maximum efficiencies and helps you bring focus to your core business and applications.

SOC 2 & SOC 3

Service Organization Control

Ensures best practices for internal controls, physical security, availability, processing integrity, confidentiality, and privacy.

Requirements

PCI Compliant Hosting Requirements:
12-Point Checklist

PCI Compliance is all about protecting financial data, and specifically, the way that merchants process card payments, transmit payment data, and how they digitally store transaction records. The Payment Card Industry Security Standards Council is in charge of the standards required to meet this requirement. Its purpose is to create and maintain a security standard known as the PCI DSS (Data Security Standard) which each merchant must abide by.

PCI DSS is a global program that businesses and organizations around the world must uphold if they want to accept payment cards, such as credit cards or debit cards. PCI compliance is critical for many businesses, so we have created a list of the principal PCI-compliant requirements that every PCI DSS-compliant web host should meet.

If you are just starting your journey into PCI-Compliance, remember that Atlantic.Net is standing ready to help you achieve these goals. We have 25 years of experience and we specialize in compliance solutions.

Firewall

How do I protect the network for PCI compliance?

Install and maintain a firewall configuration to protect cardholder data

The firewall is the front door to a network that must be adequately protected from internal or externally routed traffic over trusted and untrusted networks. All layers of the network are in scope, such as from the open internet, VPN connectivity, wireless networking, and corporate networks.

The network security design must be documented and amendments must be managed by change control in dev, test, and production configurations. Importantly, the flow of card data around the network must be known and documented.

Other key areas to consider are the roles and responsibilities must be defined in terms of who will manage the network (typically a network engineering team), all unused switch ports must be down and closed, all undefined traffic must be denied by default, and any discovered vulnerabilities in the network hardware must be patched.

How can Atlantic.Net help? We have several managed services available to help you secure your network. A managed firewall service will block all traffic as required by PCI-DSS, and our Network Consultancy services can help restrict internal and external network IP disclosure. Our intelligent Intrusion Prevention Service will scan packets and ensure that only permitted data traverses the payment network.


Passwords

How do I change the default configurations to meet PCI-DSS standards?

Do not use vendor-supplied defaults for system passwords and other security parameters

It is very easy for a malicious user to compromise a system if the vendor passwords have not been amended from their defaults. Default passwords are documented all over the Internet, so it is recommended to disable the accounts and create unique accounts. Any wireless network must be protected with strong encryption (minimum WPA2) and complex passwords.

PCI-DSS also requires configuration standards being met for server builds to include security and server hardening to close off vulnerabilities, operating system patching, application updates, and more. You must also only have one primary function per server; a single server must not do every task required by the business. Often front-end, DMZ, mid-tier, and backend services are divided to create a secured hierarchy, and the technical teams must be aware of the security policies put in place to protect these systems.

How can Atlantic.Net help? All our systems are already hardened to provide the best level of security and compliance. If you use our Managed Services you will automatically inherit this best practice from our audited environment. Our support teams and consultancy services can advise on patching schedules, security best practices, and more.


Defenses

How do I protect stored cardholder data?

Cardholder data should only be stored when necessary. If your organization does store permanent account numbers, or PANs (in this case payment card numbers), they should be encrypted. When displayed, the PAN should be masked and truncated; one-way hash functions based on strong cryptography can be used to render cardholder data unreadable.

The storage of full-track data, PINs and validation codes is prohibited, and there are strict rules on data retention - Remember, if you don't need it, don't store it!

How can Atlantic.Net help? Atlantic.Net systems use AES encryption as standard, and our teams are highly trained in security best practices when handling sensitive data. All employees are vetted before employment and we conduct regular training for the team. Ask about our SOC audits as well! They are a critical part of PCI-DSS.


Encryption

How do I secure cardholder data transmission?

Encrypt transmission of cardholder data across open, public networks

Sensitive data must be encrypted during transmission over the Internet, WiFi, private networks, and site-to-site connections. All websites must be secured with TLS (HTTPS), and there are strict rules on how PAN data can be transmitted. Never transmit over email, SMS, or mobile apps, as this data is easily intercepted and should be routinely monitored.

How can Atlantic.Net help? We can provide secure point-to-point VPN connectivity into our data centers, and our managed services teams can assist with key management and website certificates.


Antivirus

How do I meet PCI-DSS vulnerability protection requirements?

Develop and maintain secure systems and applications

Vulnerability scanning will identify all the known vulnerabilities affecting the infrastructure. This landscape rapidly changes, and it is important to stay one step ahead. The majority of vulnerabilities have already been identified by the manufacturers and patches are available rapidly.

Any custom applications must be built to PCI-DSS standards regarding access to and encryption of source code. Never hardcode security information into source code, and never publish to public repos like GitHub. Databases require special attention to prevent Buffer Overflow and SQL injection weaknesses.

How can Atlantic.Net help? We already invest heavily in threat reduction and are continuously monitoring our platforms for weaknesses. Our teams manage the security of the Cloud Infrastructure and our managed services teams are available to advise on patching schedules and system maintenance.


Maintenance

Should access to cardholder data be restricted?

Restrict access to cardholder data by business need-to-know

Employee roles and business need-to-know should guide the development of access controls so that unauthorized use does not occur. The basic idea of need-to-know is that you only give the extent of privileges and amount of data to a user that is necessary to conduct their tasks. Zero Trust should be integrated into your access control system, as indicated by the PCI Council’s instructions to “‘deny all’ unless specifically allowed.”

How can Atlantic.Net help? Our consultancy team can help assign the least privileges to employees and introduce technical safeguards to restrict access to cardholder data. All Atlantic.Net employees that have access to these systems are trained on the security requirements of PCI-DSS.


BusinessAccess

How can I know who is accessing my systems?

Identify and authenticate access to system components

To meet PCI compliance standards, you need to know who is doing what within the system and you want all activities to be easily trackable so that you can monitor and verify. Do not give anyone access to critical systems or data unless you have first given them a unique user ID. A password, passphrase, or multi-factor authentication (MFA) should be standard. MFA should be used for remote access. Virtual private networks, tokenization, or authentication, and dial-in should be implemented for remote use.

How can Atlantic.Net help? Our managed services teams can process and create users and computers to meet the required security parameters and enforce the correct password policy and key rotation requirements. We can configure automated alerts to identify when user accounts are not used on X days. We also offer a managed Multi-Factor Authentication service.


UniqueIds

How secure are the Atlantic.Net data centers?

Restrict physical access to cardholder data

Data is, of course, stored on real systems, and any access to physical systems presents the opportunity for theft. To achieve PCI-compliant hosting requirements, the provider’s data center should restrict physical access. Facility entry controls should be used. Before any outsider enters a space in which cardholder data is present or is being processed, they should receive a physical token that they give back before departure.

How can Atlantic.Net help? In our multiple data center locations, security is paramount. We employ a permanent security presence, and our buildings are protected by CCTV, door access controls, and access control lists. Only authorized users are allowed in the data center and all cabinets are locked. All unused network ports are closed throughout the data center and strict visitor controls are in place.


PhysicalAccess

Is it possible to monitor all activity for PCI-DSS?

Track and monitor all access to network resources and cardholder data

Being able to track exactly what a given user is doing by logging all steps they take allows you to perform vulnerability management and forensics in an organized fashion. Logs allow you to analyze something much more specifically and efficiently so that if any issues arise, you can understand how hacking or other improper use occurs. You want automated audit trails in place so that you can review any activities.

How can Atlantic.Net help? Atlantic.Net maintains detailed audit logs of all access on our systems. We use machine learning to predict unexpected access, and alerts are automatically generated to our support personnel.


Monitoring

Who is responsible for pen-testing?

Regularly test security systems and processes

Security gaps are often revealed through hacking. Testing security protocols, hardware, and software will keep you secure long-term. Check to see what wireless devices are being used with a wireless analyzer at least quarterly. Alternatively, use a wireless intrusion prevention service (IPS). Network vulnerability scans should be performed once each quarter and also following major adjustments within the network. Perform penetration testing annually at a minimum.

How can Atlantic.Net help? We perform quarterly vulnerability scanning for our compliancy hosting customers, and identified threats are responded to quickly and under change control. Annual penetration tests are conducted to test our infrastructure is in the best shape possible for our clients.


Testing

Who needs to understand the rules of PCI compliance?

Maintain a policy that addresses information security for all personnel

Beyond PCI-compliant server requirements, you also need personnel interacting with the systems to be well-equipped. Everyone on staff should know their PCI compliance responsibilities for safeguarding sensitive data. Create, update, and distribute a PCI compliance information security policy that lets your employees know about PCI DSS rules. For internal environments, create usage policies to shape expectations for employees and contractors.

How can Atlantic.Net help? All Atlantic.Net employees are trained to PCI-DSS standards for a hosting provider. We maintain multiple processes to provide the best protection, such as a risk assessment, monitoring user access to Payment Data



Always On

With hosted data centers in key metropolitan areas, we are prepared to support every geography with our extensive network and superior customer service. Our global presence reduces response latency and ensures that both you and your customers will never have to wait on your website. We standby to assist you in choosing the website eCommerce platform that’s best for you.

Our Data Center Certifications

Database Certifications

Dedicated to Your Success

Jason Coleman

Jason Coleman

VP of Information Technology, Orlando Magic

"After evaluating a range of managed hosting options to support our data operations, we chose Atlantic.Net because of their superior infrastructure and extensive technical knowledge."

Erin Chapple

- Erin Chapple

General Manager for Windows Server, Microsoft Corp.

"Atlantic.Net’s support for Windows Server Containers in their cloud platform brings additional choice and options for our joint customers in search of flexible and innovative cloud services."

Award-Winning Service

Award-Winning Service
Contact Us

Share your vision with us, and we will develop a hosting environment tailored to your needs!

Contact an advisor at 888-618-DATA (3282), email [email protected] or fill out the form below.

Get Help with HIPAA Compliance

Atlantic.Net stands ready to help you attain fast compliance with a range of certifications, such as SOC 2 and SOC 3, HIPAA, and HITECH, all with 24x7x365 support, monitoring, and world-class data center infrastructure. For faster application deployment, free IT architecture design, and assessment, call 888-618-DATA (3282), or email us at [email protected].

What is PCI Hosting?

Payment Card Industry (PCI) hosting is a type of web hosting service using datacenter infrastructure provided by web hosting companies and managed service providers (MSPs) which is PCI-ready. In this case, PCI-ready means the MSP follows the rules and guidelines laid out by payment card providers to enforce the data security standards (PCI DSS) expected to secure clients’ payment card data. These rules were designed to defend against the theft of debit and credit card information and merchant information, as well as prevent fraudulent transactions and credit card cloning in the retail sector. PCI data standards are recognised worldwide and thus, internationally, organizations that handle bankcard transactions online must use PCI compliant hosting providers who meet the strict requirements of the payment card industry (or maintain PCI compliance on their own, if hosting internally).

PCI compliant hosting enables clients or merchants to apply for PCI Data Security Standard (PCI DSS) compliance, which is essential for any business that accepts any type of payment card such as American Express, Visa, JCB, or MasterCard. PCI compliance was introduced in 2004 to provide a unified framework for improving security and reducing the threat of data breaches for all card providers. PCI-ready hosting providers can adhere to the security controls defined by the Security Standards Council (SSC); these standards create a set of rules which must be complied with in order to gain the PCI compliance certification, and these rules apply to everyone who wishes to take card payments.

There are 12 standards which make up the PCI Data Security Standard (PCI DSS) defined by the Security Standards Council, and PCI ready hosting providers must meet these standards for the client to be able to apply and pass PCI DSS compliance certification. These standards primarily focus on the securing of an infrastructure provider’s physical network, employees and secure business processes.

All data networks (physical and wireless) must be secured with firewalls, which are regularly maintained with software updates and have a valid access control management process. The firewalls are managed by a specialist network team, who manage and restrict traffic from untrusted networks. All vendor-supplied hardware default passwords are changed and then hardened with complex secure passwords and strong cryptography (SSL/TLS Certificates).

The Managed Service Providers and Web Hosting Companies must do everything possible to protect cardholder data, working with clients to ensure that only the data that is needed is digitally stored, and that any data that is retained is masked and protected. PCI compliant hosting providers will secure server hardware both physically and within the Operating System by ensuring the server infrastructure is protected from vulnerabilities. This includes regular patch management and anti-virus definition updates.

Strong access control measures are implemented to restrict unnecessary physical access to data center operations. PCI compliant hosting providers also restrict logon access to the server environment. This can be achieved via two-factor authentication and will add greater protection to the servers that host the payment card information. Limiting access to those on a need-to-know basis enables a web hosting provider greater auditing control. This is further enhanced by ensuring all users have unique IDs which are protected with complex, regularly changed passwords.

PCI requirements only apply to the cardholder data environment (CDE); they do not apply to a client’s entire infrastructure. Usually the CDE is an isolated network segment, but this does mean that any data transmitted externally is encrypted. The MSPs and Web Hosting Companies are responsible for documenting, updating and consistently monitoring and testing PCI ready processes to ensure the best practices requirements are followed and adhered to. The web hosting provider does this by implementing a PCI Hosting security policy and conducting regular vulnerability testing.

New York, NY

100 Delawanna Ave, Suite 1

Clifton, NJ 07014

United States

San Francisco, CA

2820 Northwestern Pkwy,

Santa Clara, CA 95051

United States

Dallas, TX

2323 Bryan Street,

Dallas, Texas 75201

United States

Ashburn, VA

1807 Michael Faraday Ct,

Reston, VA 20190

United States

Orlando, FL

440 W Kennedy Blvd, Suite 3

Orlando, FL 32810

United States

Toronto, Canada

20 Pullman Ct, Scarborough,

Ontario M1X 1E4

Canada

London, UK

14 Liverpool Road, Slough,

Berkshire SL1 4QZ

United Kingdom

Resources