Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the necessary payment info, then passing that data to a third party merchant that processes the payment, then completing the transaction if everything is good.

When the issue of PCI/DSS compliance was raised, they said:

You wont need PCI certification because the clients browser will send the sensitive information directly to the third party merchant when the transaction is processed. However, the process will be transparent to the user because all interface and displays are controlled by us. The only server required to be compliant is the third party merchant's because no sensitive card data ever touches your server or web app.

Even though I very much so trust and respect the knowledge of our web developers, what they are saying is raising some serious red flags for me.

The way the site is described, I am sure we will not be using a hosted payment page like PayPal or Google Checkout offers (how could we maintain control over UI if we were?) And while my knowledge of e-commerce is laughable at best, it seems like the only other option for us would be to use XML direct to communicate with our third party merchant for processing.

My two questions are as follows:

  1. Based off everything you've read, is "XML Direct" the only option they could conceivably be using, or is there another method I don't know of which they could be implementing?
  2. Most importantly, is it true our site does not need PCI certification? As I understand it, using the XML direct method means that we do have to be PCI/DSS certified, and the only way around getting certified is through a payment hosted page (i.e. PayPal).
share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Based off everything you've read, is "XML Direct" the only option they could conceivably be using, or is there another method I don't know of which they could be implementing?

There are more ways then XML Direct to use a third party for payment. An example of this is Authorize.net's Direct Post Method (DPM). DPM lets you host the payment form so you have total control of that page's look and feel. When the form is submitted it is sent directly to Authorize.Net for processing. When the transaction is complete the users is taken back to your website. You never touch the credit card information but have total control of the look and feel of the entire process.

Most importantly, is it true our site does not need PCI certification? As I understand it, using the XML direct method means that we do have to be PCI/DSS certified, and the only way around getting certified is through a payment hosted page (i.e. PayPal).

If you are accepting payments through your site in some way there are PCI compliance to be aware of. However, most of the tough stuff is handed off to the payment processor. You are left with fewer issues to deal with. So you're not completely absolved of PCI compliance like that developer says but most of it is taken of your hands and what is left is easier to implement.

share|improve this answer
    
Regarding the "fewer issues to deal with"... do you have a link or know a site where I could find examples or lists detailing which issues would fall under my companies realm? –  Moses Jun 28 '11 at 23:29
    
This PDF is "plain english" explanation of PCI. You know what you'll be doing better than I do so I can't give you exact details. But if you thumb through this guide you'll be able to spot what applies to you quite easily as it is specifically is designed to be easy to understand. –  John Conde Jun 29 '11 at 0:06
add comment

Unless the page they are entering their CC info on is on a different domain (IE paypal redirect) I would always worry about PCI.

Now, this does not mean you need to meet the PCI level 1 requirements (IE read only database of every transaction kind of stuff), but it does mean you should follow the requirements for level 4. See the Visa requirements as they are the most strict I believe.

This FAQ should also help out so you are better informed.

Level 4 is not a significant cost barrier, so I would always suggest to do that. The majority of the scanning vendors basically just run your IP against a tool like Nessus, but it still helps to CYA in case you get hacked or compromised.

Cheers

share|improve this answer
    
Just found this from the FAQ: pcicomplianceguide.org/pcifaqs.php#6 –  ChrisV Jun 29 '11 at 1:54
    
This is good info, I'll make sure to look into level 4 reqs and see if that will work for us. Thanks. –  Moses Jun 29 '11 at 16:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.