[gravel]

Originally Posted by zorg

The major part of online stores currently operating could be configured to actually become out of the scope of PCI-DSS certification (in this case a store should not store, process or transfer cardholder data). Guidelines on configuring X-Cart in this manner can be found at http://help.qtmsoft.com/index.php?title=X-Cart:User_manual_contents (see "Configuring X-Cart to meet PCI DSS").

Thank you Yury for finally commenting on this important question. In the part of the manual you point to, it says:

Disable background payment methods

With a background payment method, customers input their credit card data on the side of X-Cart at the final step of checkout. Since X-Cart itself is taken out of PCI DSS scope and does not comply to PCI DSS requirements, you must disable all background payment methods in your store. This does not really mean that you will not be able to use background payment methods to accept payments online: an interface to use such methods is now fully supported by X-Payments, which is PA-DSS compliant.

What this says is that anyone using, for instance, Authorize.net AIM, which is indeed a background method, would have to use X-Payments. Do you really think that such installations are in the minority? Don't the vast majority of shops prefer to NOT have their customers go off-site during checkout (as happens with, for instance, Authorize.net SIM)? Isn't that why there is so much clamor for X-Payments to be released - and for older versions of X-Cart?

The you say:

Depending on your needs we'll also prepare guidelines and patches on using X-Payments with other X-Cart versions, LiteCommerce and other open source e-commerce software.

Really? "Depending on your needs"...!? How could you not understand that many, many X-Cart users NEED a suitable version of X-Payments?

With all due respect, I think you do not know your customer base very well.

I am confident that I speak for many X-Cart users: Please make releasing X-Payments for ALL versions a top priority.