View Single Post
  #51  
Old 11-18-2009, 01:19 AM
  xplorer's Avatar 
xplorer xplorer is offline
 

X-Cart team
  
Join Date: Jul 2004
Posts: 925
 

Default Re: X-Cart and PCI-DSS / PA-DSS compliance

Hi folks,

1. More info on system requirements for X-Payments:

First of all, X-Payments will require a dedicated server. It is not because of its performance, it is due to the PCI DSS requirements. I believe that no stores hosted on shared servers will ever be verified as PCI DSS compliant. The only exception are stores that don't collect credit cards via the store website

Also, if you host X-Payments with other web applications on the same server, the server will require a special configuration because PCI DSS dictates a payment application (X-Payments) to be isolated from other applications (your website, X-Cart, forums and other web applications). It can be done either on the hardware level (different hardware servers) or on the software level (firewalls and jail systems).

Most likely X-Payments will require PHP 5.3 and MySQL 5.

It will require an SSL certificate.

2. How it will look in the storefront:

When a customer places an order and chooses a payment gateway handled by X-Payments, he will be redirected to a payment page hosted by X-Payments.

X-Payments will act like payment gateways hosting payment pages on their websites: it will collect credit card data, request a payment transaction and redirect the customer back to X-Cart

The difference is the domain name. With X-Payments you can control the payment page URL. For example, if your store is located at http://www.mystore.com/ , you can install X-Payments at https://payment.mystore.com/

So, the payment page will be on a different subdomain, but on the same domain with your X-Cart store
Reply With Quote