A service provider that delivers shared infrastructure or services to multiple customers from a common environment, such as a cloud or hosting platform, a SaaS application or a hosted payment application. PCI DSS Appendix A1 places additional requirements on these providers: logical separation between the provider and each customer and between customers, penetration testing of that separation at least every six months, audit logging for each customer's environment that only the owning customer can review, support for forensic investigation of any customer's incident, and a secure way for customers to report incidents and vulnerabilities. In v4.x this appendix was broadened and renamed from its earlier shared hosting provider framing.
Applies to. A third-party service provider whose customers sit on the same servers, applications or databases: shared hosting, SaaS platforms, hosted checkout and cart services, hosted payment applications and cloud environments all fit. Appendix A1 applies on top of the main requirements. As a service provider, the entity also carries the service-provider-only requirements, for example executive ownership of a compliance programme (12.4.1), scope confirmation at least every six months (12.5.2.1) and a documented scope review after significant changes to its organisational structure (12.5.3).
Example. A cloud hosting company runs the web shops of many small merchants on shared virtual hosts and a shared database cluster. Under Appendix A1 it must keep each merchant's environment logically separated from its own and from every other merchant's, test that separation by penetration test at least every six months, keep audit logs for each merchant that only that merchant can review, be able to support a forensic investigation for any one of them, and give merchants a secure way to report incidents and vulnerabilities, while its main-body assessment covers the shared platform itself.
Limits. Not every service provider is multi-tenant: a provider that gives each customer dedicated hardware and software is a service provider without Appendix A1 obligations. The v3.x term 'shared hosting provider' described a narrower group; v4.x widened the appendix to any shared-resource model, including SaaS. Appendix A1 adds to the twelve main requirements rather than replacing them. A customer of a multi-tenant provider keeps its own PCI DSS obligations and needs to know which requirements the provider covers and which remain its own.