Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Does anyone know if authorize.net's SIM rids you of having to be PCI compliant? The payment form is hosted on authorize.net's site and they're processing the payment.

I know you can do a relay response which basically puts some of the transaction details in a url that goes back to your website(to display a receipt). I'm not sure what all information gets put into the url though. I'm wondering if that makes you have to become PCI compliant?

share|improve this question

migrated from stackoverflow.com Sep 1 '11 at 18:10

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers 2

It doesn't necessarily rid you of it but it does reduce your potential exposure. If you handle or store any data covered by PCI DSS standard, and if you use relay response you will, then you have to make sure you meet the portion of the standard that applies to that data.

share|improve this answer
    
do you know what standards i will need to meet to use the relay response? I'm trying to code something that does a certain thing depending on the success of the transaction but i can't afford $3k/month for PCI compliant web hosting and the slew of other stuff you need to be PCI compliant –  David Jul 19 '11 at 14:48
    
It doesn't take $3000 a month to meet the requirements when you're just doing SIM. It's mostly having some policies and procedures in place, having good logging and keeping your server up to date. As for hosting, Amazon EC2 is PCI certified, a micro instance would cost you $14.40 per month. –  Dan Grossman Jul 20 '11 at 4:33
add comment

If you're not storing, transmitting, or otherwise processing card data then you don't have to worry about PCI compliance as you're not doing anything connected to what PCI compliance covers.

If a customer fills out a form and POSTs that data to authnet, the responsibility is on them. If your server is intervening in any way then obviously that's a different story. Unless you're changing the demo API code for SIM/DPM I would bet that you're not intervening.

Authnet will deliver to your server a transaction ID, customer shipping address, etc., along with the card type and last 4 digits, which is all okay for you to store according to PCI documentation.

See this other answer for more links to interesting information on this topic: http://stackoverflow.com/questions/4495496/what-can-i-store-locally-while-still-being-pci-compliant-using-braintree-in-rail

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.