1

I have recently have read that the Credit Card (saved) payment method is not meant to be used on a live site.

What are the reasons for this?

I understand this method stores the credit card number encrypted in the database. Does this violate PCI compliance?

Is there any other reason then security risks?

Improve this question
8
  • 3
    If a hackers gets into your site, the key in your local.xml will un-encrypt all your data in the database
    – brentwpeterson
    Commented Aug 11, 2014 at 19:24
  • The security risk is obvious. I was curious if there were other reasons.
    – Steven Lynn
    Commented Aug 11, 2014 at 19:43
  • The obvious reason is the obvious reason... Circular reference that needs no further explanation or elaboration. Magento tells you on their website that CE is not PCI compliant. The database must be on a separate server behind a firewall that locks down access and that's only a start. Anybody who cracks the application server access has instant access to all the card and customer data.
    – Fiasco Labs
    Commented Aug 11, 2014 at 20:32
  • I was just questioning if there were other reasons. I do not appreciate your rudeness. I understand security is the main risk. I also understand that software can not be PCI compliment. I read through the information and it sounds like a lot of pain to be compliant. As long as I am PCI complaint I can store credit card numbers correct? That is what I am wondering.
    – Steven Lynn
    Commented Aug 11, 2014 at 20:45
  • @StevenLynn I think that storing the credit card numbers along with the key to un-encrypt them will make you un-compliant
    – brentwpeterson
    Commented Aug 12, 2014 at 12:25

1 Answer 1

Reset to default
4

The main reason would be security of your customer's information. If anything where to happen with the credit card information you could be held liable.

Being PCI Compliant goes well beyond having an encrypted database. You can find all the information about PCI Compliance here

Dan

www.ecommercewebsites.biz

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.