I'm developing an eCommerce site and using SagePay as a card processor.
Customers will enter their delivery/invoice details into a form which is then submitted to a checkout page. This page encrypts the data and sends it over to SagePay to process the payment. No credit card details are entered or stored on my site, this is all handled by SagePay. The address details only are stored in my database.
My question is what sort of security do I need to implement ?
As I see it, my options are:
- Use an SSL to provide a secure site
- Encrypt the address details before insertion into the database (I'm intending to do this anyway)
- Do nothing
For reference, the site is written in Coldfusion.