Unless you actually maintain full payment account numbers, PCI compliance pretty much boils down to "I pinky-swear I'm not doing anything wrong" and the rules have virtually no teeth.