9 ms·
How do those places ever pass a PCI audit? One of the first things the auditor asks is "please show me proof that your testing is never done with real credit ca
by Rygian 2y ago
How do those places ever pass a PCI audit? One of the first things the auditor asks is "please show me proof that your testing is never done with real credit cards"
(Unless they're getting their test environments PCI certified, which sounds like a waste of money.)
- hermanradtke 2y agoDon’t do it in staging/test environment. As a sibling commented stated: smoke test in production with corporate cards.
- deleted 2y ago[deleted]
- bdcravens 2y agoMost companies are never PCI audited because they're using a provider who already has been (like Stripe)
- jabart 2y agoAt volume you can no longer self-certify to be PCI SAQ-D. There are limits based on transaction count or volume.
- bdcravens 2y agoMakes sense. What are those volume limits like? I suspect the lion's share of companies like Stripe are those under those limits (since the largest companies are willing to trade simplicity for better rates) edit: according to a quick search, it looks like it's 6M transactions/year to require an audit vs self-assessment
- deleted 2y ago[deleted]
- closeparen 2y ago>Every single place that I ever worked at in a past 20 years tests payments using real cards and real API endpoints. Yes, refunds cost a few pennies and sometimes can't be automated, but most payment providers simply do not offer testing APIs of a sufficient quality. I think this means their own real-money credit cards, that they spend a few bucks on for testing purposes. Not customer credit-card data.