6 ms·
Do I have to be PCI compliant if I use them?
by the_mitsuhiko 14y ago
Do I have to be PCI compliant if I use them?
- michaelfairley 14y agoIf your business accepts credit card payments, you must be PCI compliant.
- chmike 14y agoWhat means PCI compliant ?
- carlsednaoui 14y agoFirst result on Google - but here it is anyways: http://www.pcicomplianceguide.org/pcifaqs.php#1 http://www.pcicomplianceguide.org/pcifaqs.php#1
- jpkrohling_jpk 14y agoYou don't have to be PCI compliant to use Paymill, due to our "javascript bridge" solution. In short: the payment details never touches your server, removing the PCI compliance requirement.
- michaelfairley 14y agoAny merchant that accepts credit card payments must be PCI compliant. Even if cardholder data never touches the merchant's servers, the merchant still falls under the scope of SAQ A[1]. 1: https://www.pcisecuritystandards.org/documents/pci_saq_a_v2.pdf https://www.pcisecuritystandards.org/documents/pci_saq_a_v2....
- jacques_chester 14y agoMost gateways are structured so that your own systems never see card information.
- jusben1369 14y agoAnybody involved with credit cards needs to be "compliant" The question is not yes or no but always around "Scope" Solutions that effectively use hosted payment pages (or even better in some ways a transparent redirect) so that the card data don't touch your servers usally allow you to just complete a SAQ-A (a self assessment one or two pager) So you must always be compliant but something like this (Stripe, Braintree etc) allows you to minimize scope to the SAQ-A level typically. (Caveats apply. You could build the best application in the world but if your support people start taking credit cards over the phone to help out customers who are struggling and 'set them up' you of course broaden your scope immediately so common sense still applies)