I'm trying to set an automated approach to do the following:
- Customer signs up for a 30-day trial. Enters CC#, but is not charged for 30-days until free trial converts.
- CC# is verified (but not charged) on initial registration.
- CC# is NOT stored in cleartext in my database (need PCI compliance).
- IF account is active (i.e. I don't manually delete account), the account will automatically recur a monthly transaction every 30-days .
I have Aegir and store Admin set up with Authorize.net. I just signed up for Auth.net ARB, but I'm unsure how I set this up to accomplish what I'm describing above. As you can see in the screenshot below, I can manually charge the CC through the Admin interface, but that would imply that I would need to go in and charge the CC# in 30-days, and then manually every 30days thereafter.... That will become unmanageable quickly... As I said, I signed up for Auth.net's ARB, but the documentation on setting this up with Drupal is pretty poor. http://screencast.com/t/kB0xixRAerIo
Secondly, and perhaps a bigger problem with Drupal, is the fact that as the admin, I can see the customer's full CC# right there in cleartext when I click "view card details". Yikes. There must be a big mistake in all this, but don't know where. http://screencast.com/t/Kj46n17spnRq
Should I sign up for Auth.net's CIM to capture/store/hold customer's CC# throughout free-trial period, and then charge and and convert to ARB for automated monthly charges? If so, I'm stumped on how to set this up.
And... lastly the primary issue I have is that orders are being rejected due to no Bill-to address being populated with Auth.net. The order page shows no bill-to data was recorded, but when I look at the registration side, I can see that the bill-to address info was indeed captured. There seems to be some missing link where the bill-to address data recorded at registration is not being passed through to Auth.net (but CC# and name is being passed through). So it's the missing Bill-to data that is causing the rejection on Auth.net side. Any thoughts on why this address data is not being populated on Auth.net's side?
Thoughts/leads? we have a couple SyAd guys stumped on this. Thanks!
