4

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to the reseller. BAD... I know. The only security they had implemented was the page was SSL.

The client then signs into their wholesaler account and charges the card there.

As a new client, we told them this is bad and needs to be handled differently.

So my question is, what would be the proper method for temporarily storing credit card data? Or do you know of a service that the full credit card data can be passed to but not charged and is secure, PCI compliant? They'd have to sign in to view the credit card, and then charge it via their wholesale account.

I really don't want to store credit card data in their website's database... I inquired, asking if the wholesaler provided them with silent post options, or am embedded form they can use.

I looked into Stripe but it stores the card as a token.

Any advice is much appreciated.

I just honestly think this whole request from my (potential client) is out of whack and I want to make sure we handle it correctly, securely, and properly.

migrated from programmers.stackexchange.com Nov 12 '14 at 2:37

This question came from our site for professionals, academics, and students working within the systems development life cycle.

1

Well if your wholesaler does not offer an automated way to process data, you're going to have a hard time not storing the credit card info. This means that you probably will also have to get SAQ-D.

Storing a token of a card is not the same as storing the card details. In your case you will have to store the PAN and Verification code for as long as the transaction (in this case charge by the Wholesaler) isn't made. Storing that data is what you want to avoid. A token is a lot better in this case. You will still have to be very careful how you store these tokens, but since you do not store sensitive CC data, you are not required to get SAQ-D.

  • @Lucas_Kauffman Thank you. The card information is really only needed for about 10 minutes or however long it takes the reseller to sign into their account and charge the card. Can you elaborate on the token method? I mean I can program something that would encrypt the card data and decrypt it in an Admin protected page. or is there a service for this that is easily integrated? Thanks again. – user1447679 Dec 19 '14 at 21:24
0

It sounds like Authorize.Net's Customer Information Manager (CIM) would be a good solution.

From http://www.authorize.net/solutions/merchantsolutions/merchantservices/cim/:

Use Customer Information Manager (CIM) to tokenize and store your customers'
sensitive payment information on our secure servers, simplifying your PCI DSS
compliance as well as the payments process for returning customers and recurring
transactions.
-1

Could they not utilise something like a sagepay (UK ) set up? everything hosted on sagepay site nothing stored their end? There are cost implications but would reduce the scope massively if all outsourced.Sorry if this has already been mentioned or os too obvious but just a thought.

Jim

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.