2

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card details. When they submit the form, a script will send that info to the NetPay API, which will process the transaction and return a status code.

Can someone advise on what PCI stuff we as a business, and the client should be aware of?

I've been direct to the NetPay site, the PCI site, various other provider sites but none of them answered my question really. From what I can see as they're a low transaction (qty) business, they'd need tier 4, but seeing as we're using the API, not a hosted form or anything to do it, it might be different. Please note we're not storing ANY card details, and we will have SSL. Edit: We're also hosting the site through OVH's network, however due to it being API based I imagine the server will need to be in a PCI DSS compliant data centre too...

Thanks in advance folks, Ash

1
  • Welcome to Security Stack Exchange! Nov 15, 2016 at 23:13

2 Answers 2

2

If your e-commerce site neither stores, processes nor transmits PCI data, then you can take what is known as Attestation A. This is what you do when you use a so-called "Payments 2.0" provider, such as CyberCash, etc. Some providers host the form for you, others provide a POST API, or both.

Who hosts the capture form is not so important, but where the POST goes to is -- if the capture comes to your site, you cannot take Attestation A. If it goes to CyberCash (or whoever), you can... since the PCI data never touches your site or your database. In this case, the User's browser transmits directly to the payments provider, not you.

Nevertheless, you still have to engage a QSA to verify your Attestation A eligibility.

Example form: https://www.forte.net/images/Sample_SAQ_A.pdf

0

I'm not a QSA, but I do have some PCI familiarity. It sounds like you'd want to fill out/comply with "SAQ-D Service Provider" - look in PCI's document library for that.

Your form takes the customer's credit card number, so my understanding is that you are indeed on the hook for PCI.

3
  • Hey @crovers, thanks for this. Looks.... 'interesting' lol. I'm looking into it now and also updated the question about hosting too as I seem to have missed that out! Thanks mate, I'll have a quick read through.
    – AshboDev
    Nov 15, 2016 at 15:13
  • Welcome to the exciting world of PCI compliance :)
    – crovers
    Nov 15, 2016 at 15:15
  • Woooooooo! Definitely having a beer when I get home. It's gonna take some time to get my head around this stuff!
    – AshboDev
    Nov 15, 2016 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .