I've been having a conversation with a client about PCI compliance and realised that there's a basic fact that really should be made very clear. Any provider that tells you that they're going to solve all your PCI compliance issues only by switching payment providers is lying. PCI compliance cannot be solved purely by switching providers. PCI compliance involves how you handle credit card credentials everywhere, not just on your website. If you are inputting credit cards numbers that someone has sent you by email, phone, or letter, then you have a compliance issue. Anyone who is selling you a service to solve your PCI compliance issues and doesn't explain that to you is not trustworthy. In this case, it was a Braintree salesperson that I'm calling out. Braintree is a division of Paypal, and I would expect better of them. To be fair, some aspects of PCI compliance may be easier with some providers compared to others. But you're not off the hook, you can't