6

Possible Duplicate:
Storing credit card details

I'm working on creating an architecture for a site where users can login and buy products. My boss would like the checkout page to remember the user's credit card info so they don't have to enter it every time, like Amazon.

I don't want to store credit card info in a database for a variety of reasons; I refuse to do it. But my boss insists on the site remembering the user's credit card info.

So, how can this be accomplished? It obviously is being done, unless sites like Amazon are storing user's credit card info and making it extremely secure.

Community
  • 1
  • 1
Steven
  • 18,761
  • 70
  • 194
  • 296

3 Answers3

7

Some companies do indeed store credit card information. If they're responsible, they conform to the Payment Card Industry Data Security Standards. This can be quite expensive, so companies often partner with third parties to handle these transactions.

Jeff Sternal
  • 47,787
  • 8
  • 93
  • 120
  • One such third party being PayPal. – Christian Mann Nov 04 '10 at 20:06
  • 1
    I can't upvote this enough. If you plan on storing the card data yourselves....then you better make damn sure you secure this information or you will have a lot of pissed off and angry customers when your site gets hacked and compromises their information. – Dismissile Nov 04 '10 at 20:08
6

You could use a service like Authorize.NET's Customer Information Manager CIM. Many other payment gateways offer similar solutions. You store the payment information with them once, then make future requests for payments using a payment profile ID instead of the actual payment information. Another popular company that offers similar services is Braintree Payment Solutions.

John Sheehan
  • 77,456
  • 30
  • 160
  • 194
-4

Why not encrypt it and make a decryption program that will only allow one CC at a time to be accessed? Maybe something like that would work.

I guess even before that, you have to ask yourself whether or not the user even wants that type of functionality. The only web sites that I might want to keep my CC info stored on are Amazon.com, PapaJohns.com, and maybe one or two others. If you are selling pool equipment, doors, stereo equipment, or something like that, your boss is an idiot.

TimFoolery
  • 1,895
  • 1
  • 19
  • 29
  • 5
    Ah yes, if we get hacked at least they'll be SLOWLY getting all the CC details one at a time instead of all of them simultaneously. Please remind me what concurrency has to do with security? – bot403 Nov 04 '10 at 21:53
  • Hopefully you would detect it by the time they got more than a few hundred. Losing 250 is a lot better than losing 100,000. – TimFoolery Nov 09 '10 at 17:08