Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

If I am not storing credit card info, do I have to be concerned with PCI-compliance?

I will be using a payment processor with a bank in my country. Literally just taking the credit card info and passing it to the gateway and processor. I would love to get an idea of the various technologies I might need to consider from an software architectural point of view.

What are the best practices in terms of accepting credit cards and reducing fraud risk on my end?

I will be creating the app in Rails.

share|improve this question
1  
Part of PCI compliance deals with transport as well, which it sounds like what you're doing; that is, the customer gives you the credit card number, and it's present in application memory, but never persisted to a database (although this is not as straightforward or robust as may be imagined). If you want to avoid those headaches, I'd recommend attempting to use processor that provides an API that absolves you of the need to even collect the card information (ie PayPal). –  Clockwork-Muse Jul 24 '12 at 16:39
add comment

1 Answer

PCI regulations are not US laws, they are rules put forth by the various credit card companies, being outside of the US doesn't exempt you from complying with them.

First thing to determine is what payment processor you are going to use, that will pretty much set the direction for everything else.

share|improve this answer
    
You are right. I am reading up about PCI-compliance. I will be using a payment processor with a bank in my country. I don't plan on storing any CC numbers, will I still need to be PCI-compliant? Literally just taking the credit card info and passing it to the gateway and processor. I would love to get an idea of the various technologies I might need to consider from an software architectural point of view. –  marcamillion Apr 25 '12 at 2:52
    
@marcamillion: you will need to talk to your payment processor about that. You will have to comply with whatever regs they have. –  jmoreno Apr 25 '12 at 2:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.