3 ms·
Hey Dan, the plan is too eventually be a standalone recurring billing system. ;) So things like ARB become optional not required & things like switching gateway
by auston 16y ago
Hey Dan, the plan is too eventually be a standalone recurring billing system. ;) So things like ARB become optional not required & things like switching gateways are not impossible (as would be the case with stuffing all of your customers into ARB).
- dangrossman 16y agoHave you thought it through that far? That implies building a PCIDSS certified solution, with tons of additional requirements. I doubt there are (m)any individuals, small businesses or startups that can legally do their own gateway-independent recurring billing. The physical security, documentation, policy and extra hardware requirements in addition to the huge (half a million dollars per violation) liability make it infeasible. If someone just downloads your code and starts storing the cardholder data on the same server, even encrypted end to end, that's still not nearly PCIDSS compliant, so they're violating their merchant account agreement and hugely liable if it leads to any kind of data theft. It would be wonderful if there was an easy way to be payment gateway independent for recurring charges without meeting the 3-digit number of PCIDSS requirements, but I don't think that can come from any code project.
- auston 16y agoDan, those are my aspirations. I would not place a PCI compliance stamp on the project because no matter what, people can use it "incorrectly". I am not against supporting ARB, but it is a big vendor lock in & I think it makes sense to have options.