Timeline for Using a Public-Key-Encryption browser side to avoid PCI compliance
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 5, 2017 at 2:04 | comment | added | John Downey | @NickG yes because your server still impacts the security of the transaction. Things like malicious javascript can extract the credit card data out of the page. What you're describing is typically called Direct Post in documents. You can read more about the reasoning in Understanding the SAQs for PCI DSS version 3. | |
| Jan 4, 2017 at 17:42 | comment | added | NickG | Is this true even if the form posts directly to a PCI compliant 3rd party over SSL? (Our server would have no visibility of the card details) | |
| Aug 1, 2014 at 18:03 | comment | added | Timee | You have to be PCI compliant if you are involved in storing, processing or transmitting credit card data. The question is what level of validation is required and what SAQ is most applicable to your situation. From the PCI SSC it comes down to who is generating the payment forms. They have put out some good FAQs lately on this. See this one, and this one. | |
| Aug 1, 2014 at 10:43 | vote | accept | framp | ||
| Aug 1, 2014 at 3:03 | comment | added | John Downey | Yes! Any business that takes credit card information needs to be PCI compliant. We definitely try to point that out in our FAQ. What the Braintree integration does is try to help reduce the burden as much as possible. When properly implemented, you would qualify for using the SAQ A-EP form of the self-assessment questionnaire. This is pretty much the same story as the other providers you mentioned. | |
| Aug 1, 2014 at 1:49 | comment | added | framp | Thanks a lot for the fast response! If having a form is enough to make your server fall within PCI scope, do you need to be PCI compliant even to use Braintree API? Looking at this tutorial I was under the impression that the server wouldn't need to be PCI compliant - and the only difference would be that, instead of sending a Braintree token, we would be sending the encrypted data. | |
| Aug 1, 2014 at 1:14 | history | answered | John Downey | CC BY-SA 3.0 |