"hosted fields" are really just a fancy CC # widget (with postal code and exp built-in, when appropriate). If you use them, the annual PCI attestation becomes a checkbox instead of a giant form.