Re: PCI DSS Information Security Policy

Well, we don't have an "app" that does this. And we do not store credit
card data in any way.

We sign on to a secure website (https://) and enter the transaction
manually. The first time for a customer (and there are only 6 using cc
because we put a stop to further ones) they give us the card data over the
phone as we're keying it in. Subsequent transactions we just search for
their customer number, select some old transaction to "rebill", change the
amount and run it. By using a thin client with a browser isolated on it's
own VLAN, I'm hoping to qualify for SAQ C-VT if you know what that means.

Hmm. I wonder if our bank has a setup to do it this way: Instead of _us_
going online and entering a cc via virtual terminal, the _customer_ would
go online and enter a payment to. Email us a receipt with the cc# X'ed
out. That would be better yet as we are never in possession of anything
except the money. Is that what the SAQ A is all about?

Yes, I would like to know the name of the folks you used.



On Tue, Mar 31, 2015 at 3:31 PM, Sam_L <lennon_s_j@xxxxxxxxxxx> wrote:

That's what we did at my last job. We were relatively low volume, < 100
transactions a day. CIO absolutely did not want any credit cards numbers
on our system. If it would be helpful, I can probably get you the name of
the folks we used.

Sam


On 3/31/2015 2:19 PM, John Jones wrote:

Yep. Basically you update your web app to transfer to the provider, they
accept the card info, then transfer back to your app with a token that
tells your app that the transaction was successful. Similar to the
"Verified by Visa" processing you may have experienced when buying
something online.

On Tue, Mar 31, 2015 at 2:07 PM, Dan <dan27649@xxxxxxxxx> wrote:

We average 20 credit card transactions _per month_. Yes, per month.

It is an unchanging set of 6 or so customers.

At this volume, I'm wondering if you'd be better off, financially and
complexity-wise, using an external service to handle your credit card
transactions. I have no experience with this, so this is just off the
top
of my head. Uh, I guess this is what John was suggesting with the "cloud
provider".

- Dan
--
This is the PC Technical Discussion for IBM i (AS/400 and iSeries) Users
(PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com


--
This is the PC Technical Discussion for IBM i (AS/400 and iSeries) Users
(PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.