4 ms·

This looks like a good solution for larger companies, but (someone correct me if I'm wrong) it likely won't be a good fit for a fast moving startup. The last th

This looks like a good solution for larger companies, but (someone correct me if I'm wrong) it likely won't be a good fit for a fast moving startup. The last thing you want to worry about when developing a product is PCI compliance and other security measures. Platforms like Braintree and Stripe allow you to bypass most of this as CC and Bank info never really touch or pass through your own servers.

pamonrails 12y ago
You can still delegate PCI to your payment provider (via tokenization). SafeKiddo[0] just launched using Kill Bill + Braintree. [0] https://www.safekiddo.com/ https://www.safekiddo.com/
- tegansnyder 12y ago
  PCI DSS 3.0 will change that
  - zrail 12y ago
    Not substantially. You'll need to do minimal, common-sense things on your servers (firewalls, IDS, etc) and certify that you're not storing anything interesting.
- jusben1369 12y ago
  What did SafeKiddo see in the Kill Bill API's that was lacking in Braintree's own recurring/subscription API's?
  - piggity 12y ago
    There are small things - e.g. you can't do weekly / fortnightly billing. Once I discovered that I stopped investigating BT for our primary subscription engine. We just hold the card tokens and use BT to charge the card. It's not ideal, but it does give us more flexibility.
    - jusben1369 12y ago
      Got it. Thanks very much.
  - slgeorge 12y ago
    I can see the value of having an OSS solution as an API layer for any start-up that has complex billing needs. A lot of start-ups make the "mistake" [1] of locking themselves into fundamental business services at the start: whether that's a payment provider, finance or CRM system. In my experience it's fine for a while, but you really feel the problems as you start to scale the business. Everything creaks and groans as you grow, and then you have to go back and fix the underlying business processes. Issues in some of these areas are actual company killers. Billing is a classic. Lots of companies fail due to running out of cash, and poor management of subscriptions and billing is often the underlying issue. There's a lot to be said for not getting tied in early on, and making sure the fundamental architecture is right! [1] You can argue it's not a "mistake" as the primary goal is to relentlessly focus on shipping product that customers want.
chatmasta 12y ago
Everybody talks about PCI compliance as if it's some huge obstacle impossible for startups to overcome. It's actually extremely simple. See the requirements on the last page of this doc. [0] Basically, what you need is: - Firewall (default on almost any cloud host) - No vendor-supplied default passwords (not audited, and you should do this anyway) - Encrypt the credit card number IF YOU STORE IT AT ALL - Put a privacy policy on your homepage That's it. Super easy. Takes an hour. The hardest part is writing (or copying) a privacy policy. If you aren't storing credit cards, it's even easier to be PCI compliant. [0] https://www.pcisecuritystandards.org/documents/PCI_DSS_v3_AOC_ServiceProviders.docx https://www.pcisecuritystandards.org/documents/PCI_DSS_v3_AO...

pamonrails 12y ago

You can still delegate PCI to your payment provider (via tokenization). SafeKiddo[0] just launched using Kill Bill + Braintree. [0] https://www.safekiddo.com/ https://www.safekiddo.com/

tegansnyder 12y ago
PCI DSS 3.0 will change that
- zrail 12y ago
  Not substantially. You'll need to do minimal, common-sense things on your servers (firewalls, IDS, etc) and certify that you're not storing anything interesting.
jusben1369 12y ago
What did SafeKiddo see in the Kill Bill API's that was lacking in Braintree's own recurring/subscription API's?
- piggity 12y ago
  There are small things - e.g. you can't do weekly / fortnightly billing. Once I discovered that I stopped investigating BT for our primary subscription engine. We just hold the card tokens and use BT to charge the card. It's not ideal, but it does give us more flexibility.
  - jusben1369 12y ago
    Got it. Thanks very much.
- slgeorge 12y ago
  I can see the value of having an OSS solution as an API layer for any start-up that has complex billing needs. A lot of start-ups make the "mistake" [1] of locking themselves into fundamental business services at the start: whether that's a payment provider, finance or CRM system. In my experience it's fine for a while, but you really feel the problems as you start to scale the business. Everything creaks and groans as you grow, and then you have to go back and fix the underlying business processes. Issues in some of these areas are actual company killers. Billing is a classic. Lots of companies fail due to running out of cash, and poor management of subscriptions and billing is often the underlying issue. There's a lot to be said for not getting tied in early on, and making sure the fundamental architecture is right! [1] You can argue it's not a "mistake" as the primary goal is to relentlessly focus on shipping product that customers want.

chatmasta 12y ago

Everybody talks about PCI compliance as if it's some huge obstacle impossible for startups to overcome. It's actually extremely simple. See the requirements on the last page of this doc. [0] Basically, what you need is: - Firewall (default on almost any cloud host) - No vendor-supplied default passwords (not audited, and you should do this anyway) - Encrypt the credit card number IF YOU STORE IT AT ALL - Put a privacy policy on your homepage That's it. Super easy. Takes an hour. The hardest part is writing (or copying) a privacy policy. If you aren't storing credit cards, it's even easier to be PCI compliant. [0] https://www.pcisecuritystandards.org/documents/PCI_DSS_v3_AOC_ServiceProviders.docx https://www.pcisecuritystandards.org/documents/PCI_DSS_v3_AO...