I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to make sure this is secure and trustworthy (and also legal)?
5 Answers
I've used Authorize.Net on many e-commerce projects and have never been anything less than thrilled with their service and security. Actually, their security is so good that it can be a little annoying at times. But I suppose that's a good problem to have.
They have a ton of options, from a real easy "transfer control from your site to ours" for credit card processing to a completely customizable "roll your own" service with a rich (and slightly complex) API.
The back-end processing is full featured as well, letting you (or the business owner) have complete control over settling transactions, issuing credits, and so on.
It's real nice.
I've heard nothing but good things about Braintree.
They break down PCI compliance to the basics - if it enters your environment, you need to be compliant. As a result they have a solution that eliminates you needing to worry about it by posting sensitive information directly to them!
We are using cybersource for all of our payment and transaction needs. By using cybersource you don't need to store your customer's credit card information in your database and you still can let them pay with their credit cards.
-
I believe cybersource is a reseller for authorize.net. So aren't they are essentially the same service?– Keith GFeb 1, 2011 at 4:53
For anyone in the UK - we use SagePay who basically offer the same as Braintree.
They allow you to bypass PCI Compliance by storing all of the secure information for you.
