Which Payment Methods meets payment security standard?

Question

Which Payment methods fulfill payment security standard(PCI Compliance)?

• Authorize.net
• Authorize.net Direct Post
• Saved CC
• Paypal Express Checkout
• Paypal Payment Gateway
• Paypal All in one
• Ogone
• Sage Pay
• Ogone Direct

Answer 1

I'm not an expert on PCI compliance by any standard but I've had to deal with it a lot over the years. It has been the subject of debate at work several times.

I think people carelessly throw the term PCI-compliant around a lot.

Unless your server environment has passed a full PCI audit and is certified as compliant then you'll need to take some extra steps to protect your customer's data. The easiest way is to take them off-site to have their payment processed on a PCI-Compliant payment platform.

The only Magento "on-site" payment method that meets PCI compliance is the Enterprise Payment Bridge. Any payment method that takes you off-site into a secure PCI-compliant environment is also acceptable like Authorize.net SIM or Paypal Express.

The way I've had it explained to me by experts in this field is that typically accepting CC and billing info on-site in your own checkout = No. Being taken off-site to a secure & trusted PCI-Compliant 3rd party = Yes.

• Authorize.net

No. Unless you're using SIM or using this through the Payment Bridge, Magento's Auth.net method keeps you on-site and is not PCI-compliant.

• Authorize.net Direct Post

Same as above. The customer's payment information is entered on your server and is not truly PCI-Compliant.

• Saved CC

Never use this in a production environment. Ever.

• Paypal Express Checkout

Yes. This takes you off-site into Paypal's secure environment.

• Paypal Payment Gateway

No. For the same reasons as Auth.net above.

• Paypal All in one

No. For the same reasons as Auth.net above.

• Ogone
• Sage Pay
• Ogone Direct

I've never set up these three methods so you'd have to investigate it or e-mail them to find out.

Answer 2

Paypal Express and Amazon payments would be for sure. Also authorize.net since the processing happens on their servers. You definitely want to stay away from the saved credit card method.

If you use paypal pro there is a free extension called tokenization, that can save credit card tokens in a PCI compliant way. It compliments your paypal pro account.