---
title: "Does the Applicant fully outsource payment card processing?"
url: https://insuranceposture.com/questions/third-parties/applicant-fully-outsource-payment-card-processing
category: "Third parties and vendors"
canonical_key: q_ven_004
evidence_state: attested
updated: 2026-08-24
---

# Does the Applicant fully outsource payment card processing?

URL: https://insuranceposture.com/questions/third-parties/applicant-fully-outsource-payment-card-processing
Section: Third parties and vendors
Evidence state: Attested, not tenant-verifiable

A yes here removes a whole category of exposure from your submission. It is worth confirming that it is actually true.

## What the carrier is actually asking

The carrier is asking whether card data never enters your environment: no storage, no processing, no transmission through your systems. Full outsourcing means the customer's card details go directly to the processor, typically through a hosted page or an embedded field that your systems never see.

## Why it is underwritten

Card data attracts a distinct set of liabilities: card brand assessments, forensic investigation requirements, and account data compromise procedures that operate independently of general breach law. Removing card data from your environment removes all of it.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

This is a question about your payment architecture, so it is attested. The technical check is where card data actually flows.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Payment architecture | How card details reach the processor | Hosted page or direct-to-processor field, with no card data traversing your servers. Attested |
| Web application | Scripts running on the payment page | Third-party scripts on the payment page can capture card data even with a hosted field, which is the skimming attack pattern |
| Business processes | Phone orders, email, and customer service | Whether staff ever handle card details manually, which pulls those systems back into scope |
| Microsoft 365 | Content discovery for card-shaped data in mail and collaboration | Card numbers arriving by mail, which happens whether or not you invited it |
| Compliance documents | The self-assessment questionnaire type applicable to your flow | The questionnaire matches the architecture, which is how the outsourcing claim is evidenced |

**Customers send card numbers by email**

Regardless of your architecture, some customers will email or read out card details. Those messages sit in mailboxes, inside your scope, indefinitely. A data loss prevention rule that blocks and deletes them is the practical control, and it is what makes a full outsourcing answer actually true.

## What a defensible yes requires

- Card data reaches the processor without traversing your systems.
- Scripts on the payment page are controlled, since a compromised script defeats a hosted field.
- Manual channels are addressed, including phone and email.
- A rule detects and removes card data that arrives in mail or collaboration.
- The questionnaire type on file matches the architecture you describe.

## How this answer goes wrong

The web flow is fully outsourced and the customer service team takes card details over the phone into a notes field, or a scanned form with card details sits in a shared mailbox. Either brings systems back into scope that the compliance position excluded.

## If this answer turns out to be wrong

When the loss originates at a vendor, the application answers about that vendor are the first document the adjuster reads. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Does an embedded payment field count as outsourced?

Generally yes, when the field is served by the processor and the data never touches your servers. The page still needs script control, because skimming attacks target the page rather than the field.

### What about stored cards for recurring billing?

Tokenisation at the processor keeps you out of scope. Storing the actual number, even encrypted, does not.

### Do we still need a questionnaire?

Yes, a shorter one. Full outsourcing reduces scope substantially and does not eliminate the obligation entirely.

### How do we handle card details arriving by email?

Block and delete automatically, and tell customers not to send them. Manual handling of these messages leaves them in the mailbox and in scope.

## Related questions

- [Is the Applicant PCI-DSS compliant, and at what merchant level?](https://insuranceposture.com/questions/data-handling/applicant-pci-dss-compliant-at-merchant-level)
- [What percentage of revenue is from ecommerce / online advertising?](https://insuranceposture.com/questions/business-profile/percentage-revenue-from-ecommerce-online-advertising)
- [Does the Applicant employ Data Loss Prevention (DLP)?](https://insuranceposture.com/questions/data-handling/applicant-employ-data-loss-prevention)
- [Does the Applicant use a cloud provider, and which provider stores the largest quantity of sensitive records?](https://insuranceposture.com/questions/third-parties/applicant-cloud-provider-provider-stores-largest-quantity-sensitive-records)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.