Hi Kyle.

As i lead some PCI-Projects in the past i would like to give some clarification to you.

The following list should give you the answer to your question:
- your company does not have to be PCI-DSS compliant as long as you do not store any creditcard-related data and you're using a certified payment module e.g. for your store
- The provider of this module must be PCI-DSS compliant, as the creditcard-data will be stored / handled on their servers
- Payment Module must be PA-DSS compliant

E.g. I would recommend to use the certified Payment-Module, e.g. from 1und1 (Germany)and  use / implement it exactly (!) as documented.

Again, don't handle any CC-Data, even not with an own input dialog or something else. The only place where the customer should be able to type his cc-data in must be the Payment-Module you use.

That means in the end, you can run your site even at home on your notebook, as long as the correct implemented module is NOT on your machine and this is the one and only and really only place where any creditcard data could be entered.

Hope that helps

Kai