6

I am working on a website in ExpressionEngine2 and need to save the user's credit card information in the database as I also need to display this in a dropdownlist in the front end (whichever credit cards are linked to the user)

Which is the best encryption method I can use to store the credit card details? I need to use the number again for processing payment. I suppose some kind of 2-way encryption?

Improve this question

2 Answers 2

Reset to default
18

READ FIRST: Payment Card Industry Data Security Standard

Do you really looked over all risks of this? The field encryption is not what you need to worry about in this case. I don't even want to advise something about encryption, because I feeling really bad even about this idea. It's no good solution to keep CC info secure enough this way .

To keep such sensitive information, your server must to be certified PCI compliant. It is means that you will needed to build a secure infrastructure & procedure around your server. It is really expensive.

The best way is use payment gateway for this. Other option is find tokenisation provider - certified organization which can keep such information. You need to check your bank - they possible provide such service. Or use third-party services - depended on area. For example for SA you can look on myGate.

Improve this answer
5
  • 2
    The secure infrastructure extends beyond the physical hardware and will include auditing everyone who may have access to the systems - this could include the cleaner who cleans the server room. It's a very large undertaking.
    – foamcow
    Jun 4, 2014 at 11:44
  • 1
    yes - needs to control everything what can be in touch with server any ways. Usually certification prepering consulting start from $50-100k just for maintenance. Very expensive. Plus regular third-party audits... it is not what possible to discuss on SE)
    – Max Lazar
    Jun 4, 2014 at 11:52
  • 5
    Just a note that most of the major gateways, like PayPal, Authorize.net, Stripe, etc all offer ways to store cards. Then you simply store a token for the card in EE. This is the best way to go.
    – Jeremy Gimbel
    Jun 4, 2014 at 12:57
  • 1
    Check out Stripe. They have an amazing API that's very simple to use for storing users credit cards.
    – Devin
    Jun 4, 2014 at 15:21
  • I think topic starter is not in country from the Stripe list. But I totally agree - I use Stripe in my last module as gateway service and it is really nice solution.
    – Max Lazar
    Jun 4, 2014 at 15:30
13

DO NOT STORE FULL CREDIT CARD INFO ON YOUR OWN SERVER.

Even if encrypted, storing full credit card data on your own server is generally a very bad idea due to the security and legal ramifications should your website/database/server ever be compromised.

Many places store the last four digits of the credit card on their server for quick access or ease of identification, but only the last four digits. The full card can be associated with the account or payment selection with a payment gateway. Whichever gateway you are using may already have built-in functionality for this, like for example PayPal:

https://developer.paypal.com/docs/integration/direct/store-a-credit-card/

This way you do not have to store the actual card number on your server, but then you are still able to allow your site members to store different credit card aliases and last four digits so they can select the one they want to use. The payment gateway then assumes the risk, PCI compliance, and the complications involved in securing their servers and the stored credit card numbers so you don't have to.

If you do still want to pursue this, then this question is actually better posed at stackoverflow as secure database encryption and PCI compliance and sensitive data storage are not really EE-specific.

Improve this answer
1
  • 6
    I wish I could +1000000 this answer. Storing credit card data on your server is extremely unwise unless you have huge resources and even then it shouldn't be undertaken lightly.
    – foamcow
    Jun 4, 2014 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.