Which Payment methods fulfill payment security standard(PCI Compliance)?
- Authorize.net
- Authorize.net Direct Post
- Saved CC
- Paypal Express Checkout
- Paypal Payment Gateway
- Paypal All in one
- Ogone
- Sage Pay
- Ogone Direct
Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this communityWhich Payment methods fulfill payment security standard(PCI Compliance)?
I'm not an expert on PCI compliance by any standard but I've had to deal with it a lot over the years. It has been the subject of debate at work several times.
I think people carelessly throw the term PCI-compliant around a lot.
Unless your server environment has passed a full PCI audit and is certified as compliant then you'll need to take some extra steps to protect your customer's data. The easiest way is to take them off-site to have their payment processed on a PCI-Compliant payment platform.
The only Magento "on-site" payment method that meets PCI compliance is the Enterprise Payment Bridge. Any payment method that takes you off-site into a secure PCI-compliant environment is also acceptable like Authorize.net SIM or Paypal Express.
The way I've had it explained to me by experts in this field is that typically accepting CC and billing info on-site in your own checkout = No. Being taken off-site to a secure & trusted PCI-Compliant 3rd party = Yes.
No. Unless you're using SIM or using this through the Payment Bridge, Magento's Auth.net method keeps you on-site and is not PCI-compliant.
Same as above. The customer's payment information is entered on your server and is not truly PCI-Compliant.
Never use this in a production environment. Ever.
Yes. This takes you off-site into Paypal's secure environment.
No. For the same reasons as Auth.net above.
No. For the same reasons as Auth.net above.
I've never set up these three methods so you'd have to investigate it or e-mail them to find out.
Paypal Express and Amazon payments would be for sure. Also authorize.net since the processing happens on their servers. You definitely want to stay away from the saved credit card method.
If you use paypal pro there is a free extension called tokenization, that can save credit card tokens in a PCI compliant way. It compliments your paypal pro account.