2

I'm developing an e-commerce website for a client on Shopify, usually shopify integrates with many gateways, but for this instance, the client asked us create a custom checkout that integrates with a payment processor that is not supported by Shopify.

The development is done and everything is working fine (the site didn't go live yet), however I just got the genius idea to check if the process is PCI DSS compliant. I hope you can advice me on this:

  • Site is developed on Shopify
  • Customer checks-out and enters card data on the Shopify site.
  • Data are transmitted to our server (droplet) on Digital Ocean via an AJAX request.
  • HTTPs cert of the server is from Let's Encrypt

  • I just performed an online PCI DSS compliance test on https://www.htbridge.com and the results seem good except for one problem (which I try to solve asap): enter image description here

  • The total price and shipping rates are recalculated on the server & and the date are send to the Payment Gateway.

  • Only order data is stored, everything except card info.




I have several questions:

  • Am I out of the woods yet, or it is still a long road ahead of us?
  • Is there an official PCI DSS compliance cert? is it obligatory?
  • Who would check the validity of the process? how & when?
Improve this question
5
  • just get a better cert, probably will end up being one that's not free... I wouldn't spend money at a site under a free cert; it just seems amateurish and scammy; with a validated cert i know where my money went.
    – dandavis
    Commented Jun 17, 2017 at 18:17
  • great, I will look into it. however, do you know which PCI merchant level is this? and can you take a look at the questions at the bottom?
    – user2517028
    Commented Jun 17, 2017 at 18:28
  • Users don't go looking at what CA issued a certificate; they just look at whether it's "green", or more importantly, general good design and a lack of errors.
    – Xiong Chiamiov
    Commented Jun 18, 2017 at 19:25
  • I guess there are new norms to credibility since 2002,but at this point credibility is not as important as being liable for any misconduct in implementing the checkout process.
    – user2517028
    Commented Jun 18, 2017 at 21:34
  • htbridge only tests the TLS aspect of PCI Compliance, which is just one chapter of many, it's not a comprehensive PCI Compliance test.
    – Lie Ryan
    Commented Jun 19, 2017 at 0:30

2 Answers 2

Reset to default
2

You may still have some way to go I'm afraid.

If the card data touches your server, then your server is in scope.

If your server not segmented from the rest of the network then your whole network is in scope. This could include physical access to buildings and every desktop in the company.

You can get an audit if you want to be super sure you are compliant but that is usually only done by people selling solutions.

It's a bit late in the day, but if shopify doesn't support this gateway then you should probably try to find a 3rd party that does. The major selling point of this sort of provider is that they handle the PCI compliance for you. If not prepare for headaches.

Improve this answer
3
  • The card data is sent to the server which is hosted on PAAS (digital ocean), and then the card data is sent to the processor. can you expand more about "the rest of network is in scope", which network? & Since there is not 3rd party solution, what would you suggest I do from here?
    – user2517028
    Commented Jun 18, 2017 at 5:25
  • I'm not particularly familiar with digital ocean, but if they can promise that your server is isolated from everything else then you have saved a massive headache. The other thing to watch out for is web server logs, as if a service errors the request or response containing the data may be persisted.
    – ste-fu
    Commented Jun 18, 2017 at 7:46
  • Specifically, because the card data touches the server directly, it's not only in scope, but it's subject to SAQ D, the most onerous of them all.
    – Bobson
    Commented Jul 19, 2017 at 9:57
1

There are third party Qualified Security Assesors which are Auditors that are trained in PCI audits your company and they can issue independent PCI Audit report. If you want to go that route, you'll want to search for and contact an auditor that does service in your country. This is usually necessary only if you have business partners that requires you to produce evidence of PCI Compliance before conducting business with you.

In many cases, PCI Compliance can be self audited. You'll want to start with the Self Assessment Questionnaire.

In most jurisdictions, PCI is self-regulated by the payment industry, so compliance is enforced by banks and payment processors. If they find that your site is related to a lot of fraudulent transactions, they can require you to produce evidence of compliance. If they find you not to be in compliance, they can impose fines, restrictions, or in the worst case they may refuse to handle your payments and you may end up with a situation where no payment processors will be willing to take card payments for you. For many online business that relies on card transaction, this can spell the end of the world. Additionally, there are some jurisdictions where PCI Compliance is also a legal requirement, which carries additional legal penalties.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .