Re: FN-FORUM: credit card payments without pages hosted on providers servers

date posted 2nd October 2006 12:41

[EMAIL REMOVED] wrote:
>> [EMAIL REMOVED] wrote:
>>
>>> If we use an 'API' from one of the providers we can do it that way, but that
>>>
>> means we have to record all the transaction details and store them on our
>> sever which needs to conform to 'PCIDSS' standards (which = £££), so its not
>> really an option.
>>
>> Why do you have to store the transaction details in this case? You just
>> call the merchant API in realtime, so when the user submits the final
>> checkout page, you pass the credit card details to the API and receive
>> an immediate response, which you can then relay back to the user in the
>> same page request - no local storage required. You can of course still
>> log whatever details of the transaction you will need later, except for
>> the credit card number and similar info.
>>
>> Dave
>>
>>
>
> Logically yes, theres no reason for us to store the information, just 'bounce' it through to their system... but every payment provider I've spoken to says that if we go the API route WE become responsible for storing the data. It seems like its part of the payment providers conditions of using the API. Do you know of a company that would allow API use without us capturing the details?
>

But that implies that you're storing the data somewhere, so if you never
do that, you're in the clear - or at least that's how I've understood
these rules in the past. As long as the card details are encrypted in
transit between the customer and your site (via an SSL certificate), and
your site and the merchant API (via whatever method the API provides for
this, probably SSL again), never written to disk on your server, and
erased from memory as soon as the transaction is complete, there's no
available location for an attacker to gain any card details.

Dave