Thread

Hi,

I have been building a shopping cart website (with the excellent Cartthrob) and at registration there’s an option for customer to store their credit card details, which are then stored as Custom Profile Fields in the customer’s member account.

Is this the most secure place to keep them? and is there anything you would recommend I do anything other SSL to make these details safe?

thanks,

Sam

I don’t have a suggestion for you on this one.. what do the CartThrob people have to say on the issue?

FWIW, I’d recommend that you do NOT do this. AFAIK, there’s no way to encrypt/encode the contents of a custom profile field, which means that the credit card numbers would not be stored securely in the DB. Which opens you (or your client) up for some potential liability. At the very least, I think this means that you would not be PCI compliant.

I recently build a site using CartThrob, and at most, it’ll store the last 4 digits of the credit card number as part of the order. More info here:

Like most ecommerce systems, CartThrob was built with security in mind, and can be made secure simply and effectively. At a minimum, nowhere in CartThrob’s system does it store any raw credit card data at any time. Numbers, magnetic stripe data, primary account numbers, and CVV2 numbers are not stored natively by CartThrob.

I kind of thought so, seemed too good to be true.

I’ve just found this in the Cartthrob settings:

Last Four Digits Storing entire credit card numbers is not a safe idea, and not PCI compliant. You may store the last 4 digits of a credit card for future reference and still maintani PCI compliance.

Along with info from https://www.pcisecuritystandards.org I reckon it makes perfect sense not to open us up to risks.

I was after an easy method for customers to re-order, although, only having to add their card numbers at checkout is not too much of a drag, as their address details will still be stored on the system.

Thanks again, and I’ll stop thinking I can afford the security Amazon has on offer!

Thanks for the assist, Jason.

Sam - Feel free to start a new thread if you have any more questions.