: PCI compliance when using third-party processing My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to

@Odierno851

Unless the page they are entering their CC info on is on a different domain (IE paypal redirect) I would always worry about PCI.

Now, this does not mean you need to meet the PCI level 1 requirements (IE read only database of every transaction kind of stuff), but it does mean you should follow the requirements for level 4. See the Visa requirements as they are the most strict I believe.

This FAQ should also help out so you are better informed.

Level 4 is not a significant cost barrier, so I would always suggest to do that. The majority of the scanning vendors basically just run your IP against a tool like Nessus, but it still helps to CYA in case you get hacked or compromised.

Cheers

Vote Up Vote Down

@Kevin317

Based off everything you've read, is
"XML Direct" the only option they
could conceivably be using, or is
there another method I don't know of
which they could be implementing?


There are more ways then XML Direct to use a third party for payment. An example of this is Authorize.net's Direct Post Method (DPM). DPM lets you host the payment form so you have total control of that page's look and feel. When the form is submitted it is sent directly to Authorize.Net for processing. When the transaction is complete the users is taken back to your website. You never touch the credit card information but have total control of the look and feel of the entire process.


Most importantly, is it true our site
does not need PCI certification? As I
understand it, using the XML direct
method means that we do have to be
PCI/DSS certified, and the only way
around getting certified is through a
payment hosted page (i.e. PayPal).


If you are accepting payments through your site in some way there are PCI compliance to be aware of. However, most of the tough stuff is handed off to the payment processor. You are left with fewer issues to deal with. So you're not completely absolved of PCI compliance like that developer says but most of it is taken of your hands and what is left is easier to implement.

Vote Up Vote Down