6 ms·
Things you have to look at fast. * Money laundering. Cap fees now. * You are using Stripe, but you're still collecting CC data. Are you PCI compliant? * Do
by jasonlotito 16y ago
Things you have to look at fast.
* Money laundering. Cap fees now.
* You are using Stripe, but you're still collecting CC data. Are you PCI compliant?
* Does Stripe allow you to do this? Really? Basically, you're acting as a third party processor, an IPSP. People can sell anything through your service (Think adult content)
I'm really interested if Stripe is aware of what you are doing and fine with it.
- pixeloution 16y agoPCI compliance is only an issue if he's storing CC data.
- ojilles 16y agoI'm no expert, but I don't think this is true. I've witnessed a few payment systems being implemented, and just having this data pass through your system you need to adhere to some compliance rules (which are softer vs. actually storing the data though).
- train_robber 16y agoCorrect. We are doing a PCI compliance certification right now, for a service that does the same CC flow as this. We don't store, but just forward. But even that requires a PCI certification.
- jasonlotito 16y agoThat's not true. If CC data is passing through his system, their are things he needs to be aware of. You'd be surprised at the logs that are generated by people who don't store credit card information. Somehow, that unstored CC information winds up in a random logs directory, unencrypted and open for anyone to see.
- rprasad 16y agoTrue, but "storing" is very broadly defined. "Storing" CC data in logs or temporary folders is enough to fall under the purview of the PCI rules.
- Secure128 16y agoComing from direct QSA experience, you can be liable for CC data if you are collecting, transmitting, or storing the data. Basically any touchpoint in the flow of CC data you're involved in holds you legally liable for PCI-DSS. Kind of like speeding on the freeway... doesn't really matter until you get nailed doing it, and PCI council fines are devastating. I'm glad to discount our product extensively for any bloggers here... https://www.secure128.com/trustwave-trustkeeper-pci-compliance.aspx https://www.secure128.com/trustwave-trustkeeper-pci-complian... Just drop me a line to say hello and I'll give you whatever price you feel reasonable.
- sahillavingia 16y agoYes they're aware. Fees are already capped. I'm not collecting CC data.
- jasonlotito 16y agoThat's cool. Far too many people ignore what a solid relationship with the upstream payment provider can give you. Glad the fees are capped. I saw a $100 link, so not sure about what the cap is. As for collecting CC data, if it's passing through your code, even if you don't store it, you are accountable for it. I've seen the silliest things with people claiming they aren't storing CC data. And yet, you can browse file after file of automatically generated logs that contain raw CC data. That you aren't storing CC data makes your life easier. However, I'd still review what you are liable for just in case. I don't say any of this bash you (I really like the idea!), but so you avoid any problems that cause you to shut down (because it's a cool idea!). I've been doing this for 10 years now, and as soon as someone opens up a payment system like this, money laundering and other schemes will review how to abuse it. So when I see something like this, I get nervous. I ask: how would I exploit it.
- Natsu 16y ago> I've been doing this for 10 years now, and as soon as someone opens up a payment system like this, money laundering and other schemes will review how to abuse it. So when I see something like this, I get nervous. I ask: how would I exploit it. Maybe you should write a guide of all the ways you've seen people go wrong and the best ways to do things (and why). That could be useful to a lot of people on HN.
- jasonlotito 16y agoI should. =) I take what I know for granted too much, I think.
- forensic 16y agoHe could sell the guide on Gumroad