PCI Shared Responsibility Matrix
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards that applies to every organization that processes, stores, or transmits credit card information. Meeting it for an UltraCart store is not a single party's job. UltraCart, acting as your ecommerce provider, is responsible for the payment processing infrastructure and the technical controls around it. You, as the merchant, are responsible for what you add to your own checkout — most significantly, any custom JavaScript that runs on the checkout page.
This page states that division so both sides know exactly what they own. It reproduces UltraCart's Shared Responsibility document, which is classified for public use and can be shared with your acquiring bank, payment brand, or auditor.
Why PCI responsibility is shared
Responsibility is split because each party controls a different part of the payment environment, and only the party in control can secure it. UltraCart manages the foundational infrastructure and technical security controls, drawing on its expertise in payment processing and cybersecurity. You manage the parts within your direct control, such as customizations to the checkout experience.
That delineation matters for three reasons:
- Specialization — each party focuses on its strengths: UltraCart on technical infrastructure, you on your own business processes.
- Comprehensive coverage — every facet of PCI compliance is addressed, with no overlap and no gaps.
- Risk mitigation — clear roles reduce the chance that something is overlooked, which improves the overall security posture.
For example, UltraCart secures the payment gateway and the underlying systems, while you must ensure that any custom JavaScript you add does not introduce vulnerabilities — such as cross-site scripting (XSS) — that could compromise the checkout page.
The shared responsibility matrix
The table below lists each area of PCI DSS compliance, the party accountable for it, and what that accountability covers.
| Area of Responsibility | Responsible Party | Description |
|---|---|---|
| Payment Processing Infrastructure | UltraCart (ecommerce provider) | The entire payment processing system — including hardware, software, and network components — must be secure, resilient, and compliant with PCI DSS requirements. This includes maintaining up-to-date systems and safeguarding the infrastructure against unauthorized access. |
| Encryption and Protection of Cardholder Data | UltraCart (ecommerce provider) | All cardholder data must be protected using strong, industry-standard cryptographic methods during transmission over open networks and while stored. UltraCart implements, tests, and maintains these encryption mechanisms to prevent data breaches. |
| Network Security and Firewalls | UltraCart (ecommerce provider) | Robust firewalls must be deployed and maintained to shield the cardholder data environment from external threats. UltraCart configures, monitors, and regularly updates firewall rules to block unauthorized access and ensure network integrity. |
| System Configuration and Maintenance | UltraCart (ecommerce provider) | Systems must be securely configured by disabling unnecessary services and applying security patches in a timely manner. UltraCart oversees the initial setup and ongoing maintenance to mitigate vulnerabilities and ensure compliance with PCI DSS standards. |
| Access Control and Authentication | UltraCart (ecommerce provider) | Access to cardholder data and related systems must be strictly limited to authorized personnel. UltraCart implements and manages access control policies, including multi-factor authentication and role-based authorization, to prevent unauthorized use or disclosure of sensitive information. |
| Vulnerability Management and Patching | UltraCart (ecommerce provider) | Regular vulnerability scans and penetration tests must be conducted to identify and remediate security weaknesses. UltraCart oversees this process, ensuring that patches are applied promptly and that the environment remains secure against evolving threats. |
| Monitoring and Logging | UltraCart (ecommerce provider) | All access to network resources and cardholder data must be systematically logged and monitored for anomalies. UltraCart establishes and maintains logging systems, routinely reviewing logs to detect and respond to suspicious activity or potential breaches. |
| Incident Response | UltraCart (ecommerce provider) | In the event of a security incident, a well-defined incident response plan must be activated immediately. UltraCart develops, tests, and executes this plan to contain, mitigate, and recover from breaches effectively. |
| Compliance Validation and Reporting | UltraCart (ecommerce provider) | Regular assessments must be performed to validate PCI DSS compliance, and the required reports must be submitted to stakeholders such as acquiring banks or payment brands. This includes maintaining documentation and evidence of adherence to all applicable requirements. |
| Custom JavaScript on Checkout Page | Merchant | The merchant bears full responsibility for any custom JavaScript code integrated into the checkout page. This code must be secure, free of vulnerabilities, and must not interfere with the safe processing of cardholder data. The merchant is accountable for reviewing, testing, and validating the security of these scripts to prevent exploitation. |
What you are accountable for
Your obligation under this matrix is the custom JavaScript running on your checkout page. UltraCart cannot review, test, or vouch for code that you or a third party add to your storefront, so that code sits squarely on your side of the line — including tag managers, analytics snippets, chat widgets, affiliate pixels, and anything else you install.
Any custom JavaScript you add to the checkout page is your responsibility to review, test, and validate. Insecure scripts can expose cardholder data, break checkout, or put your PCI compliance at risk — regardless of whether you wrote them or a third-party vendor supplied them.
Two features help you meet that obligation:
- The PCI Payment Script Monitor on the StoreFront Advanced screen inventories and monitors the scripts running on your payment pages. See StoreFront Advanced Screen.
- The E-commerce Compliance and Security Guide walks through the current PCI DSS script requirements and how to satisfy them in UltraCart.
If you customize checkout through the Visual Builder rather than by writing code, see StoreFront Checkout.
What non-compliance costs
Adherence to the responsibilities in this matrix is not optional — it is a safeguard against consequences that fall on both parties. Failing to meet them can result in:
- Data breaches — cardholder data exposed to theft or misuse, leading to significant financial and legal repercussions.
- Financial penalties — fines imposed by payment card brands or regulatory bodies, which can be substantial for either party.
- Reputational damage — loss of customer trust and business credibility, which is particularly damaging for merchants who rely on consumer confidence.
- Operational disruptions — for the ecommerce provider, non-compliance can lead to suspension of payment processing capabilities; for the merchant, vulnerabilities in custom JavaScript can disrupt checkout functionality.
By fulfilling their respective roles, both parties protect not only their own interests but the broader payment security ecosystem. Compliance is a shared commitment to safeguarding sensitive data and maintaining the integrity of ecommerce transactions.
Where to go from here
Use this matrix as the foundation for ongoing collaboration rather than a one-time checklist — the threat landscape and the standard both keep moving.
- UltraCart PCI Compliance — UltraCart's PCI Level 1 certification, the Self Assessment Questionnaire, and third-party ASV scanning reports.
- E-commerce Compliance and Security Guide — current PCI DSS, FTC, and fraud prevention requirements, with the steps to meet them in UltraCart.
- 2025 Intuit PCI Compliance Notice — the payment-page script inventory and monitoring requirements as they were communicated to merchants.
For additional information or clarification regarding these responsibilities, consult your compliance officer or the relevant department within your organization. You can also contact UltraCart Support at (209) 383-9870.
This page reproduces the UltraCart Shared Responsibility document, Revision 1.0 (April 1, 2025), classified PUBLIC USE. PCI compliance is a complex topic and this information is presented AS-IS; contact your legal counsel or a qualified PCI consulting organization if you are unsure of any requirement.