Is PCI compliance possible on shared virtual hosting accounts?

You seem to imply that it is not impossible for a shared virtual account to meet PCI compliance just by the fact of it being a shared virtual setup; is that correct?  I can involve the host and/or move a few hundred sites to a host that has a PCI compliant setup for shared virtual accounts if there is such a thing, but I need to know if I am on a wild goose chase looking for something that can't exist.  I have not found any by Google. I have been told by one host that offers PCI compliance and who runs dedicated, VPS, and shared virtual that only a dedicated machine can be compliant. I have been told by others that they can make their shared virtual accounts compliant although they are not now. I have been told by the present host that the reason the audits find problems are just 'false positives.' I have been told that a requirement of 'only a single use' for a compliant machine precludes anything but a dedicated machine, and I have been told by others that that is not what that requirement means. Is there a known example of a PCI compliant shared virtual host that has passed an audit?

>> You seem to imply that it is not impossible for a shared virtual account to meet PCI compliance just by the fact of it being a
>> shared virtual setup; is that correct?

No.  I think any setup can be made to be compliant, but you don't have full control over the server and config in a shared situation and that's where the host needs to get involved. It generally is not worth it for them to spend the extra time and effort overhauling their share boxes when they can just move you to the next higher level of hosting instead.

The "only a single use" clause is open to interpretation.

>> Is there a known example of a PCI compliant shared virtual host that has passed an audit?

I don't know...I only have dedicated or VPS hosting for my clients.  If you've been told by someone above that they can make their shared setup compliant, make them prove it.  However, I still think you should move to a VPS or dedicated setup if you want compliance.  

These sites are currently paying $12/month for shared virtual. Moving them to VPS would be a major hit for them in terms of cost.

To be sure I understand what you are saying, you state that it is possible for shared virtual accounts to pass a PCI compliance audit despite the "only a single use" requirement, but that it is unlikely any host would provide it. Is this correct?

Ok, I guess the answer is "maybe" and that simply reflects the state of confusion in the industry.

In the meantime I have managed to get the attention of the non-compliant host by threatening to move 400 accounts and they say they will have a compliant, shared virtual machine ready for me by tomorrow. We shall see.

Thanks.