4 ms·
Things to think about: 1. Keeping the credentials (account number, name, telephone number, credit card number, routing number and account number, etc etc). Yo
by bediger 16y ago
Things to think about:
1. Keeping the credentials (account number, name, telephone number, credit card number, routing number and account number, etc etc). You may have legal duties to perform certain things, or to delete them every so often.
2. Retries of failed payment authorizations. The ACH and credit card systems ARE NOT THAT RELIABLE. Your code will need to take account of network failure (failed to contact Paymentech or AmEx) vs a declined payment. Not the same things at all. You need to have the ability to retry an authorization.
3. Your own software failures can leave a "batch" of payments in an inconsistent state. The dangers here are double-billing a human, and on the other hand, not billing a human. In one case, your clients cry out, in the other, you miss some money.
4. Give your clients the ability to cancel a scheduled payment right up to the deadline, but don't let them schedule a payment too close to the deadline. Horrible race conditions that are hard to imagine ensue.
- pavel_lishin 16y agoUnless you know exactly what you're doing - and if you're asking this question, you don't - don't store credit card numbers at all. There is no justifiable advantage to doing this when Braintree/Authorize.net/etc provide much more secure ways to make arbitrary charges against a card.
- henrikschroder 16y agoMay have legal duties? If you wish to handle credit card details in your systems, you must pass PCI compliance, and this is something you really, really do not want to do if you're a small company.
- HNer 16y agoThis is correct, I offer PCI complaince tools and advice, for recurring billing, you will need to have pci scanning on your servers, if your hosted and not doing sys admin yourselves or if you dont have sys admin skills it's going to cost you dearly. Basic advice, use a linode, get a sys admin who knows about pci compliance, set up pci compliant approved server, check with scanning software, we offer it for 200 GBP which includes the SAQ wizard which will save you days. pcicompliance.org.uk, nightmare process. Best advice, just starting, use Paypal...
- epochwolf 16y agoI thought VMs didn't qualify for PCI compliance unless you had the physical hardware the VM runs on.