[kulture]

I use sage pay as a payment gateway, and I use the sage pay server extension. Thus the credit card form is an iframe in the one page checkout and is hosted on the sage server. Thus in theory I do not need a PCI scan. In practice I do one anyway. I do not know if there is a module for x-cart or litecommerce that uses the sage pay server interface, but it would not be too hard to develop, would look as good as the sage pay direct interface, and have none of the PCI compliance problems that even sage are now saying thattheir direct interface has. Sage now say that their server interface is the most secure.