great, now I'm the sole responsible for PCI DSS attestation. more forms to fill and policies to write, yay