Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to make sure this is secure and trustworthy (and also legal)?

share|improve this question
add comment

5 Answers 5

up vote 4 down vote accepted

PCI Compliance is a good place to start.

share|improve this answer
    
that's a great link –  Jason Jul 8 '10 at 20:05
add comment

I've used Authorize.Net on many e-commerce projects and have never been anything less than thrilled with their service and security. Actually, their security is so good that it can be a little annoying at times. But I suppose that's a good problem to have.

They have a ton of options, from a real easy "transfer control from your site to ours" for credit card processing to a completely customizable "roll your own" service with a rich (and slightly complex) API.

The back-end processing is full featured as well, letting you (or the business owner) have complete control over settling transactions, issuing credits, and so on.

It's real nice.

share|improve this answer
add comment

I've heard nothing but good things about Braintree.

They break down PCI compliance to the basics - if it enters your environment, you need to be compliant. As a result they have a solution that eliminates you needing to worry about it by posting sensitive information directly to them!

share|improve this answer
add comment

We are using cybersource for all of our payment and transaction needs. By using cybersource you don't need to store your customer's credit card information in your database and you still can let them pay with their credit cards.

share|improve this answer
    
I believe cybersource is a reseller for authorize.net. So aren't they are essentially the same service? –  Keith G Feb 1 '11 at 4:53
add comment

For anyone in the UK - we use SagePay who basically offer the same as Braintree.

They allow you to bypass PCI Compliance by storing all of the secure information for you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.