使用支付网关和 PCI 合规性
我正在考虑使用 eWay 作为支付网关。他们提供两种选择。一种是允许用户在 eWay 托管网站上输入信用卡数据，另一种是使用我自己的表单并通过我的服务器将信用卡数据发送到 eWays 后端。第二个选项（其详细信息页面）似乎更适合我，因为用户永远不会离开我的网站并且品牌将得到维护。 现在，我与支持人员交谈，他们说只要我使用 SSL，我的网站就会符合 PCI 标准。所以基本上我可以允许用户在我的网站上提供 CC 号码并通过 XML 将其发送到 eWays 后端。只要我不存储敏感数据，只传输就可以了。到目前为止，我认为只要 CC 数据到达我的服务器，我的网站就需要符合 PCI 标准，但现在我不确定。如果有人能向我解释它到底是怎么回事，我将不胜感激。
I'm considering using eWay as payment gateway. They offer two options. One is to to allow users to type in credit card data on eWay hosted website, the other to use my own form and send credit card data via my server to eWays backend. The second option (their page with details) seem more appropriate for me as user would never leave my site and branding would be maintained.
Now, I spoke to support and they said that my site will be PCI compliant as long as I use SSL. So basically I can allow users to provide CC numbers on my site and send it to eWays backend via XML. As long as I don't store sensitive data, but transfer only it is ok. Until now I thought as long as CC data hits my server my site needs to be PCI compliant but now I'm not sure. If someone could explain to me how it really is that would be much appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
看来您收到了很多相互矛盾的答案。我在一家支付公司工作，并接受了 1 级服务提供商审核，并且每天与商家及其 PCI 要求打交道，所以我想我可以帮助您解决这个问题。
现实情况是，如果您接受信用卡，则必须遵守 PCI 合规性，即使您外包所有持卡人数据功能。诀窍在于，您必须满足的标准远没有支付网关必须满足的标准那么严格，但这并不意味着“PCI 不适用”。您不必处理非常严格的网络安全要求，但您必须遵守 PCI DSS 的某些方面，并且您需要每年进行自我评估审核。
`
有关必须处理 DSS 哪一部分的详细信息，请访问 pcisecuritystandards.org 并请参阅 SAQ 验证类型 1（问卷 A）。这将准确告诉您作为所有持卡人功能均外包的商户必须实施 PCI DSS 的哪些部分。
希望这有助于您解决问题！
It seems like you have received a lot of conflicting answers. I work in a payments company and have undergone a Level 1 Service Provider audit, and I deal with merchants and their PCI requirements daily, so I think I can help clear this up for you.
The reality is that you do have to be PCI compliant if you accept credit cards, even if you outsource ALL of the cardholder data functions. The trick is that the standard you have to meet is far less restrictive than the standard the payment gateway has to meet--but this does not mean "PCI does not apply". You don't have to deal with the really tough network security requirements, but there are aspects of the PCI DSS that you have to comply with, and you are required to do a self assessment audit annually.
`
For details on what part of the DSS you must deal with, go to pcisecuritystandards.org and look at SAQ Validation Type 1 (Questionnaire A). This will tell you exactly what parts of the PCI DSS you must implement as a merchant with all cardholder functions outsourced.
Hope this helps clear things up for you!
如果您的系统处理卡数据，那么它就在 PCI 范围内，并且必须符合 PCI 标准。
http://www.pcicomplianceguide.org/pcifaqs.php
编辑； “eWays”作为您的网关提供商是第 1 级的，他们有责任确保您的 PCI 合规，因此他们用 SSL 欺骗您有点狡猾。
If your system handles card data then its in scope of PCI and must be PCI compliant.
http://www.pcicomplianceguide.org/pcifaqs.php
Edit; "eWays" as your gateway provider are Tier 1, and its belholden to them to actually ensure your PCI compliant, so its a bit dodgy of them to palm you of with the SSL spiel.
简而言之，如果您接受付款（即使您完全外包），您就需要遵守 PCI 规定。确定您需要满足多少安全控制的最大因素是您使用的支付网关的类型。
我帮助撰写了Drupal 社区白皮书，但这些概念适用于所有领域。我强烈推荐阅读它。如果您有任何反馈，请在 github 问题队列中提交问题。
In short, if you are accepting payments (even if you fully outsource them), you need to be PCI compliant. The biggest factor in determining how many security controls you need to meet is the type of payment gateway you are using.
I helped author a white paper for the Drupal community, but the concepts apply across the board. I highly recommend reading it. And if you have any feedback, please file an issue in the github issue queue.
我们最近使用另一家支付网关提供商为电子商务网站实施了信用卡交易。这就是我们对 PCI DSS 合规性的了解。
详细的 PCI DSS 要求可在此链接中找到PCI 数据安全标准
We recently implemented credit card transactions for an ecommerce site using another payment gateway provider. This is what we learnt about PCI DSS compliance.
Detailed PCI DSS requirements are found at this link PCI Data Security Standards