3

I'm designing a site using ASP.NET and I would like the content to be subscription based. For the most part, everything will be charged to a credit card every month. I know I can store the CC in the database but is there another more secure solution to this?

This isn't a giant project so I need some solution that's simple, quick, secure, and reliable that one developer can do.

John Conde
  • 217,595
  • 99
  • 455
  • 496
danmine
  • 11,325
  • 17
  • 55
  • 75

4 Answers4

4

Most likely it depends on your payment gateway and/or merchant account setup. Some payment gateways like Authorize.net will handle the recurring billing for you.

Mcbeev
  • 1,519
  • 9
  • 9
3

Use a payment processor that will handle credit card recurring charges. Most big processors will do this for you, and store the credit card information.

-Adam

Adam Davis
  • 91,931
  • 60
  • 264
  • 330
  • +1 because it's sensible. There are too many rules and regulations for data storage when talking about CC numbers. Let someone else handle it for you because you'll need a full time person to manage the security aspects alone otherwise. – Adam Hawes Mar 27 '09 at 04:33
1

Is it an option to NOT store the credit card data?

See this if you need some encouragement: PCI DSS Compliance

Scott Ferguson
  • 7,690
  • 7
  • 41
  • 64
  • I really don't want to store the data. PCI looks a bit - complex. – danmine Mar 27 '09 at 04:22
  • Good idea... trying to come up with a secure solution for storing credit cards can be a full time job. Unless it's your core business, I'd outsource it. :) – Scott Ferguson Mar 29 '09 at 23:35
0

If you store credit card information then you must be PCI compliant. Some payment gateways like Authroize.net will handle recurring billing for you but will only charge the credit card and that is it. If a credit card fails after that due to expiration you will never know, your customer will never know and you will lose that customer.

There are services out there that will charge your customer's credit card every month, automate the process if a credit card fails, automate emails to your customers, take care of the PCI compliance so you dont have to deal with it and more. One of these services is Chargify. That way you dont have to store CC information and your customers will be billed correctly.

Jake C
  • 11
  • 2