X-Payments and payment gateways
 

Just wanted to see if this is possible. Provoked by comments like "X-Payments price tag is ridiculous..."

So not sure how possible this is or the technical aspect of it as far as certification goes, or if even it will change price or not. QT can you please share your thoughts

X-Payments has like 100 payment gateways integrated. Any store using X-payments uses like 1 or 2 of them max. So what if these payment gateways are like modules and there is core X-Payments package way below $1500 and each payment gateway integration can be installed on as per needed basis for an additional cost, like a normal XC module...

Not only the price tag will go down but it will be way more cleaner and secure - if a payment module for AU has a bug in it or security hole store using X-Payments in US will not be affected by it...

Is this something that can be done this way? I would assume the certification for the application is for its core not for the payment gateways integrations....

Re: X-Payments and payment gateways
 

Just as I begin to download X-Payments as well. Steve please tell me this is a random example and not based on a current issue :wink:

Re: X-Payments and payment gateways
 

Sorry - completely random.

.... if a payment module for XX country has a bug in it or security hole store using X-Payments in country YY will not be affected by it...

How's that ;)

Re: X-Payments and payment gateways
 

LOL thanks :)

The above was fine I just wanted to ensure i was not misinterpreting your example.

Re: X-Payments and payment gateways
 

Hi Steve,

I moved this thread into X-Payments sub-forum.

For the PCI Council and industry of QSAs they implemented making a separate application for every integration means we will have to spend almost the same amount of money and efforts as we spend now on X-Payments but on having every of those applications officially certified one by one as we will have to go through separate certification process for every of them. As result our costs on maintaining PA-DSS certified status will grow sharply, too.

So basically it is the industry that pushes software makers like us to do apps like X-Payments. See Magento Payment Bridge for example.

Re: X-Payments and payment gateways
 

But the idea of having payment integrations as modules is very good indeed and we will discuss it with our PA-QSA on the next round of certification!
We depend on how the PCI Council sees such implementation. They change policies from time to time depending on feedback they receive from vendors, QSAs and merchants.

Re: X-Payments and payment gateways
 

Please do. I did not mean having separate payment application for each payment gateway. One payment application - X-Payments - its core. Then every payment gateway being its own module which is based on and integrates into the certified payment application. But I think you got this.

I think it will be very good to have it this way if allowed.

Re: X-Payments and payment gateways
 

Next question to this matter. Right now since X-Payments is one and all payment gateways are integral part of it changing or adding payment gateway requires (I assume) in most cases re-certifying the whole application.
So if X-Payments is stripped out of payment gateways will coding new payment gateway require some sort of re-certification of the core or certification of the payment gateway? Hopefully not?
This if possible will allow other devs to add payment gateway integrations as needed instead of waiting for a year or so for QT to integrate and re-certified...

Re: X-Payments and payment gateways
 

Steve, as I said we depend on the PCI Council's view on such implementation. Initially X-Payments was developed the way it was done and changing it needs discussing with our PA-QSA and the PCI Council. I do not think we will be able to implement modular architecture in X-Payments v2.x branch, but this is a very good idea for future X-Payments v3.x indeed. But again - it is to be discussed with the PCI.

E.g. a year ago adding a payment gateway was a so called "minor impact change" to the PCI. This year it can be changed to "no certification needed change" according to what I heard from our PA-QSA. Their policy changes every year.

Re: X-Payments and payment gateways