I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "secure" the data it sends halve the credit card number through email and stores the rest. The client wishes to be able to manually charge the credit cards through their financial service software due to negotiated rates. This eliminates the option to use a payment gateway like stripe.
Their current process appears to be a valid practice according to a post by webengr on this thread: https://groups.drupal.org/node/22389.
"Many of you are probably aware how zencart/oscommerce does it. The basic offline cc processor for zencard saves part of the credit card then emails the other part. http://tutorials.zen-cart.com/index.php?article=67 There have been discussions about it this is good enough to meet the 'PCI compliance' Supposedly, your business is PCI compliant as long as you are not storing Track 1 CC data which consists of the full CC number, name, expiration date."
Is this truly a legitimate practice?
How can I securely store credit cards for later manual processing while adhering to PCI standards?
- Is there a service that can store the credit card details and transaction via tokenization. Then login to retrieve the card details by the token and manually charge them through their financial service provider?
- What other security practices do you suggest? Deeper answers then using SSL.