Forum Moderators: buckworks
So, if I need to store credit cards, what hosting solution do you suggest? Do we absolutely have to have a dedicated server, or are there any PCI compliant shared hosting companies out there? As for storing the credit card info in the database using php/mysql is AES encryption good?
Is there any payment gateway service out there that will store the credit cards for us and will allow us to make additional charges to the cards when we do repeat sales without the customer having to reenter anything? I'd much rather entrust this to a trusted company than do it ourselves.
Thanks,
Paula
The cost of doing this plus a mark-up should be the customers responsibility.
Then you should have a monthly upcharge to cover the additional cost of this service.
Considering the risk, I would make it rather large upcharge.
Better yet, have the client directly pay for secure hosting and have a lawyer put together something that completely removes you from any risk.
Remember, one lawsuit can put you under.
Paula
other gateway providers probably do the same
don't risk storing card numbers - remember your client is not your boss - you are not a slave - you do not *have* to do what your client wants - it's your job to tell your client what you will do
So far, we don't request customer to sign up an account before check out, we store customer's shipping information only for every order but not billing information, our payment flow is just very simple, we pass shopping cart data to payment gateway, customer types his/her credit card information on the payment gateway.
Now we want to change programming and set up customer's account, let repeated customer input his/her billing and shipping informaton, we store it, and pass it to the payment gateway for transaction approval.
The problem is we use share-hosting service with class ASP backed by MS SQL, is that secure?
The customer would agree upon signing up that we'd be doing this. So, it's not illegal.
This is absolute nonsense.
If a customer agrees to something that is against the merchant's agreement with his or her payment processor, it does not suddenly become permissible.
You should probably not be involved in this project at all, until you are certain that your client is not asking you to aid him in violating the terms the agreement he has with his payment processor.
Personally, I'd want to review the language of the agreement myself and receive written confirmation from the payment processor that what you're undertaking is allowed--and it wouldn't take much uncertainty to cause me to back out of the project.
-b
You should probably not be involved in this project at all, until you are certain that your client is not asking you to aid him in violating the terms the agreement he has with his payment processor.
why bother with all that legal hassle when the solution is very simple - pay to use a proper payment provider that does it all for you
problem solved
Puala
There are several PCI compliant hosting providers out there.
Being PCI compliant is a combination of things - server, code, etc. So even though a host is PCI compliant will not mean you are unless your code is. And you might not even need to be PCI compliant if you are doing less than XX number of transactions per month.
And plus it is a catch 22. Visa/MasterCard want you to keep records for three years but how can you keep these records if you cannot store (credit card numbers)?
A lot of companies store CC data, but as pointed out, do not store the CCV. But at least collect that on the first transaction to pass to the gateway so the transaction provider can let you know that it matches or not. Consider even collecting that every time even.
-Corey
