4 ms·
Because when you rebill a client you have to give the number again. You can use a 3rd party gateway that acts as an intermediary between you and the bank that
by smokinn 17y ago
Because when you rebill a client you have to give the number again.
You can use a 3rd party gateway that acts as an intermediary between you and the bank that issued your merchant account and the 3rd party gateway will offer services such as scheduled rebilling. The gateway has to store the number though because the APIs at the highest level have no clue how to deal with internet and subscription type billing. They're still stuck in a very brick-and-mortar mindset. In this case it's the 3rd party gateway that has to deal with PCI compliance, not you.
If your transaction volume is high enough to justify it you can save a lot by cutting out another middleman and writing your own gateway. In this case though you generally have to be PCI compliant and have regular security audits to stay compliant.
PCI compliance only makes sense when you store CC numbers since PCI is a set of requirements on how to store them. Saying you don't store CC numbers and are PCI compliant makes no sense. EDIT: As andrewf points out below I'm wrong about this paragraph.
- run4yourlives 17y agoSaying you don't store CC numbers and are PCI compliant makes no sense. Yes I know, that's why I didn't say that. I'm wondering why you would ever (as a startup) choose to write your own gateway and not outsource this to a company that can be PCI compliant (i.e. the Gateway)
- smokinn 17y agoI wasn't implying that you were, I was just trying to be clear. Why is simple. It's the economics. If you're a startup that does lots of micro-transactions you're paying a good chunk of overhead in gateway processing fees. If you feel it's worth the continual development effort (because don't kid yourself, writing a secure internal gateway takes a long time and essentially never ends) then you do it. In Blippy's case they probably had to write their own because I don't know of any 3rd party gateway that has an API to return a list of user purchases when you give them a credit card number. I'm actually surprised the banks even support that kind of request.
- run4yourlives 17y agoIf you feel it's worth the continual development effort then you do it. I would think that when you start thinking your first application requires a second application (that you have to build yourself) just to efficiently exist, you should be taking a good solid look at the viability of your idea. In Blippy's case they probably had to write their own Case in point I suppose. PCI compliance isn't something a startup should be looking to saddle themselves with, in my mind. Once you're established and can analyze whether you want to internalize an outsourced function, it's on the table with everything else I suppose.
- smokinn 17y agoPCI compliance isn't something a startup should be looking to saddle themselves with, in my mind. Once you're established and can analyze whether you want to internalize an outsourced function, it's on the table with everything else I suppose. Exactly. That's the point I was trying to get across. Guess I wasn't very clear. =)
- andrewf 17y agoPCI DSS states: PCI DSS requirements are applicable if a Primary Account Number (PAN) is stored, processed, or transmitted. If a system accepts CC numbers from a form and then passes them to a 3rd party gateway for processing, it's within PCI scope, even if it doesn't store them.
- fuzzmeister 17y agoCertain companies (like Braintree) offer a service where the credit card data is POSTed directly to their server, relieving you of most aspects of PCI compliance.