My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via Paycorp's API (Paycorp is PCI compliant). The up stream system is a different vendor, and they are handling their environments PCI compliance assessment.
Our application receives this data, and then transmits the credit card numbers to Paycorp.
We do not store any card data, log, or record any CC information. We only transmit.
I am having a hard time working out which self assessment questionaire to fill out.
I feel as thought it doesn't fall into any category outlined here https://www.pcisecuritystandards.org/pci_security/completing_self_assessment
But I also don't feel like that justifies it being SAQ D. So which SAQ fits my circumstance?