I have recently have read that the Credit Card (saved) payment method is not meant to be used on a live site.

What are the reasons for this?

I understand this method stores the credit card number encrypted in the database. Does this violate PCI compliance?

Is there any other reason then security risks?

  • 3
    If a hackers gets into your site, the key in your local.xml will un-encrypt all your data in the database – brentwpeterson Aug 11 '14 at 19:24
  • The security risk is obvious. I was curious if there were other reasons. – Steven Lynn Aug 11 '14 at 19:43
  • The obvious reason is the obvious reason... Circular reference that needs no further explanation or elaboration. Magento tells you on their website that CE is not PCI compliant. The database must be on a separate server behind a firewall that locks down access and that's only a start. Anybody who cracks the application server access has instant access to all the card and customer data. – Fiasco Labs Aug 11 '14 at 20:32
  • I was just questioning if there were other reasons. I do not appreciate your rudeness. I understand security is the main risk. I also understand that software can not be PCI compliment. I read through the information and it sounds like a lot of pain to be compliant. As long as I am PCI complaint I can store credit card numbers correct? That is what I am wondering. – Steven Lynn Aug 11 '14 at 20:45
  • @StevenLynn I think that storing the credit card numbers along with the key to un-encrypt them will make you un-compliant – brentwpeterson Aug 12 '14 at 12:25

The main reason would be security of your customer's information. If anything where to happen with the credit card information you could be held liable.

Being PCI Compliant goes well beyond having an encrypted database. You can find all the information about PCI Compliance here



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.