Do we need X-Payments?

naemsmommy · #1 08-08-2012, 04:16 PM

I haven't worked with X-Payments yet. I have a client who wants to make sure his site is PCI compliant. He takes credit card numbers during checkout, but processes them manually. He wants to continue processing them manually. Does he need X-Payments to be PCI compliant? If not, is there anything he does need to do?

Thanks!

cflsystems · #2 08-08-2012, 05:29 PM

Unless he jumps through hoops and spends enormous amount of money I don't see how the site can be compliant if CC info is saved and processed manually. Basically it is illegal to do this nowdays no matter if X-Payments is used or not.

balinor · #3 08-09-2012, 06:13 AM

Yea, there is really no way to do that these days. A merchant is not supposed to ever see the CC data. One alternative would be to use a service like Authorize.net CIM which stores the CC data for you, allowing you to process it at will. But storing it on your own server, no matter how compliant the server is, is simply illegal.

naemsmommy · #4 08-09-2012, 10:04 AM

OK, that makes sense. I am still pretty confused about X-Payments though. He is Canadian, so needs a Canadian merchant account. He would prefer customers to stay on his site, rather then enter their credit card info on the merchant site. And he definitely wants to be PCI compliant. As far as I can tell, he'd have to use Beanstream and X-Payments to be PCI compliant and accept credit cards directly on his site, is that right, or are there other options?

balinor · #5 08-09-2012, 10:52 AM

Correct.

whisper2 · #6 08-09-2012, 01:40 PM

I am a small business owner using X-Cart. I have had X-Payments installed but now, looking at liability, I think I am still liable unless I am PCI compliant, which means spending a lot of money and time on compliance scans of my site and also having my business premises in compliance (net works etc.)

I talked to someone who told me if I send my customers to PayPal or Stripe, or someplace like that, and they enter their payment information on “their” site, I don't have to deal with PCI compliance at all.

Any suggestions ot thoughts?
Thanks in advance

cflsystems · #7 08-09-2012, 03:10 PM

If you use PP Standard or payment gateway hosted page you don't have to be compliant for the site so X-Payments is not needed. I think you still have to do the quarterly scans. PCI compiance is not only how you collect payments but also how secure your site and software is - so software and hardware

naemsmommy · #8 08-09-2012, 03:14 PM

We are looking at using Paypal Advanced, so we would still need X-Payments, correct?

Also, if X-Payments needs to be on it's own shared hosting account, does that mean we have to buy a whole new domain name just for X-Payments???

gb2world · #9 08-09-2012, 04:40 PM

You might be able to set up a subdomain, like secure.mydomain.com, which uses its own hosting account. Your host should be able to help you. QT recommends a VPS or dedicated to do this properly.
http://forum.x-cart.com/showpost.php?p=342091&postcount=18

---

ambal · #10 08-10-2012, 01:35 AM

Quote:

Originally Posted by gb2world

You might be able to set up a subdomain, like secure.mydomain.com, which uses its own hosting account. Your host should be able to help you. QT recommends a VPS or dedicated to do this properly.
http://forum.x-cart.com/showpost.php?p=342091&postcount=18

---

I also want to add that we are going to launch "X-Payments Hosted" service that will include both X-Payments (PA-DSS certified application for payment processing) and PCI-DSS compliant hosting environment at affordable monthly fee. You will be able to have your own domain or subdomain for your X-Payments Hosted account.

Subscribe for our announcement at
http://eepurl.com/kBo9v
https://www.facebook.com/xpayments
https://twitter.com/x_payments