0

First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to do this.

Here's the scenario:

  • A standard marketplace setup with vendors selling their own items and customers purchasing them.
  • Storing customer card details upon checkout
  • Later displaying a customers full card details to vendors who can then process the transaction via their own methods
  • All whilst following PCI compliance for this particular setup

Would one be breaking PCI compliance in any way and/or would this be putting the vendors at any sort of risk?

Also, are the any third-party services that would take care of storing the card data to then get via something like a web-hook? (stripe etc only return the last 4 digits)

Improve this question
6
  • Why are you delaying processing payment? Why are you capturing payment details then passing it on to the vendor who then passes it on to the card company? This does not appear to be a typical "marketplace" at all.
    – schroeder ♦
    Dec 6, 2017 at 16:32
  • It would appear to be trivial to connect to a payment processor who handles all this for the vendors.
    – schroeder ♦
    Dec 6, 2017 at 16:33
  • @schroeder By typical I mean vendors add their own products etc. Also, as I said at the beginning of the question. This isn't something that I'm actually doing. We will in fact be processing cards upon checkout. And, as I said, I'm simply interested in how others are doing this.
    – user3170211
    Dec 6, 2017 at 16:36
  • If the vendor needs you to pass on the CVV code, then this would violate PCI-DSS (it cannot be stored at all)
    – schroeder ♦
    Dec 6, 2017 at 17:05
  • You can store the CVV before processing apparently.
    – Richard
    Dec 7, 2017 at 3:57

2 Answers 2

Reset to default
0

Yes this should be possible. I know of a level one service provider doing basically as you describe. I think it’s a bad idea myself, since you rely on customers to be security conscious, and I would think it opens their PCI scope to SAQ D (which they probably don’t realise). Having said that it’s likely the customers responsibility to be PCI compliant and use PCI compliance service providers. So technically should be fine but feels like you’re playing with fire.

Try Spreedly, they let you use different gateways and also have a vault, not sure about getting the full PAN though.

Improve this answer
1
  • Thanks for the answer! I found speedily and they unfortunately don't allow you to de-tokenize any details.
    – user3170211
    Dec 7, 2017 at 1:52
0

I ended up finding the answer to this after some more research. It turns out there are services available that store card details via tokenization for you in what's usually called a vault.

By doing so you vastly reduce the scope of PCI compliance on your side of the application.

Here's a few of those services to anyone who's looking: AuricVault: https://www.auricsystems.com/auricvault/ Spreedly (you can't de-toeknize but still can store): https://www.spreedly.com

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .