My company wants to start a subscription based website and I'm implementing it with a payment gateway.

The problem is, this payment gateway doesn't give me any tools to encrypt the client's credit card information before it reaches our server.

So my question is, how should I handle this very sensitive information?

I don't plan on storing it or anything, just send it straight from the server to the payment gateway for validation.

Are we even allowed to handle plain text credit card information?

I know this is a very open subject, I just want to get directed for somewhere I can read and understand more about this issue.

closed as unclear what you're asking by Tobi Nary, Serge Ballesta, Steve, schroeder Dec 4 '17 at 22:18

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    You already used the pci-dss tag. So you know there are regulations in place and which ones apply. What exactly is your question? – Tobi Nary Dec 2 '17 at 20:03
  • I know there are regularions, but don't know what they are in this case and I couldn't find it clearly online. So this is my question: Can I handle credit card info in plain text on the server and where can I read more about this precise issue. – WilsonPena Dec 2 '17 at 20:06
  • 2
    No, you can’t, see the PCI-DSS. – Tobi Nary Dec 2 '17 at 20:07
  • PCI-DSS has free and very detailed guidance for all your questions – schroeder Dec 4 '17 at 22:18

I ran e-commerce sites for many years, and worked with many credit card processors. I'll give you my go-to answer when someone wanted to use a processor that required the CC data to arrive at our server before going to the processor:

We refused and found another processor.

That's probably not the answer you are looking for. However, credit card processors are a dime-a-dozen these days, and there are many who have APIs that actively encourage good security practices. As a result, you're looking at this the wrong way. Don't try to figure out how to secure this process. Just avoid it all together. I rarely had customers that had high enough sales volumes online to get meaningful discounts from any processors, so even if you get a processor just for your website, do it. You can always go sign up with Stripe. They have amazing documentation, a great API designed around security-first, and their pricing is reasonable.

Just don't do it. It doesn't even matter what the PCI compliance rules say. There is no reason to go with a processor that force you to expose sensitive user data in this way.

  • Thanks for the answer. I think you are completely correct and will do my best to change the approach for the project. – WilsonPena Dec 2 '17 at 20:13

In short you really don't want to handle the data at all.

Unless you are heavily contractually tied to a payment gateway that forces you to act as an intermediary then you should choose an option that allows the payment gateway and your customer to interact directly.

Most of the big players support this out of the box...there are two principal models...either you embed an iframe from the payment provider or you handle it by redirecting to their site and then back to yours once the payment is complete.

In both of those models the card data never touches your server and so you are (probably) automatically PCI compliant.

If you must act as an intermediary then you are in for a lot of extra work. You will need to ensure that no data is logged at any point and appropriate access controls are in place to ensure that nobody on your network can sniff the data by any means. This could potentially include an entire corporate network depending on your setup.

  • Thank you very much for the answer. This is exactly what I thought and wasn't completely sure. – WilsonPena Dec 2 '17 at 20:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.