So, I've been tasked to work on an integration project where we will ask customers for credit card information and send it over to our integration partners, who will process the payment/cc info and process the rest of the order. So, one the tasks for become PCI compliant. However, the partner is also looking to get PCI compliant, and they said that as part of that process, they cannot accept cc info over the internet from an external source. But then I was reading about it, and found out there is some way to become a TPA (Third Party Accepter) that can allow the passing of the credit card to the partner.
I also heard the word FDMS thrown around at the first meeting - some research led me to believe this stands for First Data Merchant Services. What I found is that First Data is a merchant processor, who actually contacts the issuing banks to check the credit cards and then collect payment. The partner wants to achieve a level of PCI compliance where they do not store credit cards, so they said when they take credit cards they will send it to FDMS using something called TransArmor, where they send the CC info to FDMS and they send back a token - and that is what they use to access the CC info.
I did my research on this, and there is a lot of information out there, and I cannot find a clear and concise place where I can read about all of this - so I have a few questions on this whole process:
- Is there one place where I can read what exactly it takes to become PCI compliant?
- Are there different levels of PCI compliance?
- Where exactly does TPA fall into all this?
- Is there an example of how TransArmor works?