I'm developing an e-commerce website for a client on Shopify, usually shopify integrates with many gateways, but for this instance, the client asked us create a custom checkout that integrates with a payment processor that is not supported by Shopify.
The development is done and everything is working fine (the site didn't go live yet), however I just got the genius idea to check if the process is PCI DSS compliant. I hope you can advice me on this:
- Site is developed on Shopify
- Customer checks-out and enters card data on the Shopify site.
- Data are transmitted to our server (droplet) on Digital Ocean via an AJAX request.
- HTTPs cert of the server is from Let's Encrypt
I just performed an online PCI DSS compliance test on https://www.htbridge.com and the results seem good except for one problem (which I try to solve asap):
The total price and shipping rates are recalculated on the server & and the date are send to the Payment Gateway.
- Only order data is stored, everything except card info.
I have several questions:
- Am I out of the woods yet, or it is still a long road ahead of us?
- Is there an official PCI DSS compliance cert? is it obligatory?
- Who would check the validity of the process? how & when?