[fido]

Thanks for pointing this out! This needs a lot more attention IMO! The PCI verbage is "store, process, or transmit", which means that if you host a payment form on your site, you are on the hook for SAQ-D.

[namityadav]

Not if you host a form. But if the form's POST goes to your server.