X-Cart forums

[rrf]

Originally Posted by Blazeland

From what I have read, that just isn't accurate. Care to lift that ban on mentioning names?

The list of certified applications is openly available on PCI council site:

https://www.pcisecuritystandards.org/security_standards/vpa/

[geckoday]

Originally Posted by rrf

The problem with making the *whole* X-Cart PA DSS compliant is with the scope of it. X-Cart has tons of features and that means really lot of code. With every line of code PA DSS audit becomes longer, harder and more expensive. And a re-certification is required for every new version. And the process of making changes to the software needs to be certified, too. So, if you take a PA DSS compliant X-Cart and have third party coder modify it, you no longer have a PA DSS certified solution.

That's why there is not a single __PA__ DSS certified solution that has a functionality anywhere near X-Cart.

And that's why we released X-Payments: to isolate payment functionality, therefore reducing the compliance scope. This also allows the store owner or third party developers to modify X-Cart without having to pay $50,000 PA DSS audit fee for every set of changes.

And this allows older installations of X-Cart to become compliant by installing X-Payments.

Limiting he scope of PA-DSS code and assessment is absolutely the right move but PA-DSS certification allows certifying only the payment modules of an application rather than the whole application. There was no need to create an entirely new application to limit scope. You would have needed to rework the X-Cart payment module architecture to ensure proper isolation from the rest of the X-Cart application but that would have been no harder than creating the X-Payments application and its connector module. And it wouldn't have been any harder to retrofit to older versions of X-Cart. There would be no PA-DSS audit required for third party or store owner mods that don't touch the payment modules.

Even if modifying the payment modules the store owner can change the code all they want without a PA-DSS audit. Store owner mods are covered under their PCI-DSS assessment and don't require PA-DSS audits. Same for one-off third party mods not sold to multiple customers. Only third party mods to the payment modules which are sold to multiple customers would require a PA-DSS audit.

Creating a new application rather than reworking the current payment module architecture has limited your integration options with the base X-Cart application. It is still possible to provide better integration than you have at this point but you made your job a lot harder.

[enterfusion]

I'm am interested in the X-Payments 1.0 Beta, please consider me for the beta program, we have several licenses that will need to become PCI complaint within this short 3-month window.

-Eric

[GreatSamps]

Hi,

Been slowly working my way through this thread, and i have a question.

We currently using the subscriptions feature of x-cart to bill on a regular basis, at present we use Payflow API to do this, but this does involve storing card details.

Will X-Payments allow this to continue, or do i need to start looking to 3rd party subscription providers?

[zorg]

Originally Posted by GreatSamps

Hi,

We currently using the subscriptions feature of x-cart to bill on a regular basis, at present we use Payflow API to do this, but this does involve storing card details.

Will X-Payments allow this to continue, or do i need to start looking to 3rd party subscription providers?

No, Subscriptions in X-Cart 4 can't be set up together with X-Payments. Pay_subscriptions.php (a part of X-Cart:Subscriptions module) itself acts as a payment processing script requiring credit card numbers to be stored in X-Cart's database.

Going into PCI-DSS you may consider configuring this on a payment gateway side or via 3rd party service provider.

[enterfusion]

Is there a separate forum or help-guide to X-Payments, I can't seem to find anything that's in this forum for just it. Also would like to know why the product information and PDF guides aren't yet available on the X-cart.com website?

This product was suppose to come out before the 7/1/2010 PA-DSS deadline correct?

[enterfusion]

Is there any more documentation or guides to installing/configuring and using the X-Payment system then what comes with it?

Also when do you plan to publically discuss the product on the X-cart.com website as one of the Products or Add-ons?

[zorg]

Originally Posted by enterfusion

Is there any more documentation or guides to installing/configuring and using the X-Payment system then what comes with it?

Also when do you plan to publically discuss the product on the X-cart.com website as one of the Products or Add-ons?

The guide can be found (and even edited) at http://help.qtmsoft.com/index.php?title=X-Payments:User_manual

X-Payments 1.0 release will be announced as soon as we implement improvements which were suggested during beta stage, and complete our PA-DSS certification.

Thanks!

[FiberGuy]

It's now less than two months to deadline.

Any news or is our @55 still in the wind?

[canuck]

I think someone asked this earlier in the thread but I didn't see a reply. Will there be a way to maintain our one page checkout mod using xpayments?

I'm starting to think I should be looking at the option of having someone write the payment gateway page as that would keep us from having to use x-payments - anyone else going down this road and am I on track here?