To avoid tons of pci "fun" it seems tokenizing is the way to go for a website. I am aware of the standard and that it's used for mobile often, but on the fly restricted tokens are possible too from what I see.
Are there any card processors that host iframes that generate tokens? This way I could use that service, and only handle a token, which I could pass along to third parties requiring credit cards.
If not I suppose I could develop my own token generator, and keep that isolated in a tiny pci scope.
Hard to find good concrete info!
