不要求站点符合 PCI 标准的支付网关
我一直在关注authorize.net，特别是他们的CIM 和DPM 解决方案。问题是我不能只在 DPM 中引用 CIM 配置文件。对于不使用authorize.net的人，基本上authorize.net管理我用户存储的信用卡（在他们的网站上），但我无法使用他们存储的信用卡的ID通过DPM进行付款，我必须从他们的服务器检索该信息，并在另一个请求中将其传回给他们。这一行为迫使我遵守 PCI 标准（因为我已经处理了信用卡号）。
我的问题是：是否有另一个提供商允许我使用类似于authorize.net 的内容，但允许我的网站永远不会触及信用卡/运输信息？
I have been looking at authorize.net, notably their CIM and DPM solutions. The problem is that I can't just reference a CIM profile in the DPM. For people who don't use authorize.net, basically authorize.net manages my user's stored credit cards (on their site), but I can't use the ID of their stored credit card to make a payment through DPM, I have to retrieve that information from their servers, and pass it back to them in another request. This act forces me to be PCI compliant (because I've handled the credit card numbers).
My question is: is there another provider that would allow me to use something similar to authorize.net but that allows my site to never touch the credit card/shipping information?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
无论如何，您的商业银行都要求您符合 PCI 标准，但如果您使用其他处理信用卡数据传输到网关的服务，则可以降低要求。
如果信用卡数据接触您的服务器，您可能需要填写自我评估问卷 C：https:/ /www.pcisecuritystandards.org/documents/pci_saq_c_v2.doc
如果您使用处理此传输的服务，您可能只需要自我评估问卷答（但请务必检查您正在查看的任何服务）：https://www.pci_saq_a_v2.doc" pcisecuritystandards.org/documents/pci_saq_a_v2.doc
免责声明：我在 Recurly 工作，这是您可以用来最小化 PCI 合规范围的服务之一。您可能还想看看 Chargify、ChedderGetter 或 SaaSy，但我很乐意回答您的任何问题。
You're required by your merchant bank to be PCI compliant no matter what, but the requirements can be reduced if you use other services that handle the transfer of credit card data to your gateway.
If credit card data touches your servers, you likely need to fill out Self-Assessment Questionnaire C: https://www.pcisecuritystandards.org/documents/pci_saq_c_v2.doc
If you use a service that handles this transfer, you'll likely only need Self Assessment Questionnaire A (but be sure to check with any service you're looking at): https://www.pcisecuritystandards.org/documents/pci_saq_a_v2.doc
Disclaimer: I work for Recurly, one of the services you can use to minimize the scope of your PCI compliance. You may also want to take a look at Chargify, ChedderGetter, or SaaSy, but I'm happy to answer any of your questions.
Infintech 允许这样做，尽管从他们的网站上看还不是很清楚。在您的网站上，您需要一种方法来识别用户，但不需要存储信用卡信息、地址或类似信息。
Infintech allows that, although it's not crystal clear from their web site. On your site, you need a way to identify the user, but you don't need to store credit card information, addresses, or anything like that.