4

I'm building a website where registered users would place future order(s). e.g. after 6 months for $20, or even on a specified date may be after one year or so.

In order to charge them on those transaction dates through paypal or any other payment gateway, we would need their credit card information to store somewhere.

What is the best way to complete the task with maximum security.

Please advice.

Edit: Currently I'm using Ubercart, but if any other module can fit for the required scenario, I'm open for that.

These would not be recurring payments, but I would rather call them "post-dated orders". I've never used any payment methods. This is my first site for shopping cart so I've no idea. If paypal can store the CC info for multiple transactions for every site member and give me option to execute the orders on specific dates, I hope that would be fine with me too.

  • 2
    I would not be storing the credit card numbers if I was you. Maybe try to make use of paypals recurring payments system. – 2pha Feb 10 '13 at 13:57
  • 2
    This is not a Drupal-specific question; there are detailed standards for what you can and can't do with credit card data that apply regardless of what software you use. – Patrick Kenny Feb 10 '13 at 14:05
  • 2
    While the guys slam you for asking this question, this is actually a legitimate request and there are many reasons for a site to store this info. eg recurring payments. See drupal.org/project/commerce_cardonfile for some help with what you are doing. – Nigel Waters Feb 10 '13 at 15:46
  • 2
    As long as it doesn't drift into the specifics of how PCI is met, I think this is on topic, and there could be a good Drupal-specific answer for this. – mpdonadio Feb 10 '13 at 17:16
  • Also, please edit the question and tags to be specific about which ecommerce and payment solutions you are using. – mpdonadio Feb 10 '13 at 17:22
13

The most secure place to store credit card numbers will be on a third party service designed to securely retain that data. These service providers are PCI Level 1 compliant with code and systems in place to prevent the unwanted or unexpected exposure of sensitive card data.

Many payment gateways support such "card on file" functionality, where they allow you to process an authorization or capture for a credit card and provide you with a token to perform follow-up transactions using that same card data. Such a transaction is generally referred to as a "reference transaction", with example implementations being PayPal's reference transactions, Authorize.Net's Customer Information Manager (CIM), or CyberSource's Managed Billing / subscriptions.

The name and price of these services will vary from payment gateway to payment gateway, but they will always require a similar point of integration in Drupal - a way to retain a payment token and process that reference transaction at a later date; typically you want some sort of customer interface as well, allowing customers to update their information or reuse a credit card on a later order.

To solve the Drupal integration, we created the Commerce Card on File module, which does all this and more within Drupal Commerce. It works through payment method callbacks, allowing any payment method module to implement the callbacks to integrate reference transactions through its payment gateway's API. Obviously, not every payment gateway under the sun is supported, so be sure to check the documentation to find out if yours is supported.

And as the comments on your original question indicate - you should never be in the business of storing card data in your site, which was unfortunately easy to do in Ubercart. Multiple times now I've been part of rescuing sites that incorrectly used the UC Recurring module to retain credit card data in plaintext in the database for later processing. Do not do this - ever.

  • 1
    wow, comprehensive answer I was wishing to have from someone. I would go for the "Commerce Card on File". And storing CC info in plain text, hummmm ... I can't even think about it. : ) – developer Feb 10 '13 at 20:16
  • Does anyone know if there is a module or solution equivalent to Commerce Card on File for Ubercart to store tokenized billing information? – Steven Aug 31 '17 at 4:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.