Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Consider situation:

I made my own payment gateway and it passes vulnerabity tests.

My store redirects to this payment gateway. Card details is collected there. Payment is processed there (not stored) and user is redirected back to our store.

So this works basically same as all payments gateways/processors like Paypal, SagePay, Cardinal etc.

Our online store don't event touch card details.

Is it PCI compilant?

Related question: PCI Compilance - Custom payment processor

share|improve this question

marked as duplicate by AviD Mar 12 '13 at 14:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Why post the same question again? The last edit in your previous question covers this question. Flagged as duplicate. – Adi Mar 12 '13 at 14:19
Hi 21886, welcome to Information Security. There is no need to ask two questions, which are almost perfectly identical, twice. Please modify your other question to include any points you feel are missing. – AviD Mar 12 '13 at 14:30

There isn't enough information here to know if it is PCI compliant. Any system which HANDLES PCI must be PCI compliant, so your payment gateway has to meet PCI requirements. As long as the payment gateway only passes a token in place of PCI data, then the PCI requirements should be limited to your payment gateway unless you are doing something odd.

If the question is about the store itself, then as long as it isn't handling PCI and is isolated from any systems handling PCI, then it wouldn't have to deal with PCI-DSS policies. As far as your payment gateway goes, PCI compliance is a complex topic and a general question about if a system dealing with PCI is compliant is probably out of scope and too localized for the Q/A format. I would recommend hiring a local PCI expert to take a look at your setup.

share|improve this answer
simply store is hosted on shared server, and gateway is going to be small server in our office. we can't affort dedicated server for store. – user21886 Mar 12 '13 at 13:42
@AJ This question was closed as an exact duplicate. It will be deleted soon - I suggest you move this answer over there, perhaps as a 2nd section in your answer. – AviD Mar 12 '13 at 14:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.