Is using BrainTree in this manner PCI-compliant?


0

According to the instructions on BrainTree's website, in order to integrate their payment solution with my Python application, all I need to do is:

  1. Sign Up
  2. Server Side Integration
  3. Client Side Encryption

I noticed that step 3 contains the following snippet of text:

PCI compliance will be a breeze.
Does this mean that using BrainTree in this way is PCI-compliant or that I am still under some sort of obligation or restriction? (I'm not terribly familiar with PCI-compliance, I'm afraid.)

Payments

asked Nov 26 '13 at 16:44
Blank
Nathan Osman
103 points
  • Seems more like a question to ask Braintree themselves. – Jim Galley 10 years ago

2 Answers


1

I've worked in IT security for a while. If you use BrainTree with server integration, you still will have to get a separate PCI compliance audit for your site, but relative to other PCI audits yours would "be a breeze" (i.e. easy). You likely will just have to fill out the self-service questionnaire, pay the fee, and wait 2 weeks for someone to rubber-stamp your approval. You then will have to do this every 1 - 3 years, depending on a lot of factors.

The reason why you have to submit the paperwork is that the customer's credit card data is going through your servers. BrainTree is guaranteeing that the credit card data is encrypted, which is why the audit process is a 'breeze,' but PCI scopes in any server that touches the card data. There are rules where some data can never be stored, some has to be encrypted, and some only should be encrypted.

If you want to avoid the PCI audit business altogether, pick a payment provider where none of the cardholder data ever touches your server. Some good options include going to a hosted payment gateway page or using 100% JavaScript (e.g. stripe.js).

answered Dec 3 '13 at 18:58
Blank
Ivan Plenty
36 points

0

I think your question would be better answered at http://webapps.stackexchange.com/ or http://serverfault.com/ where the users will be more familiar with your issue.

answered Nov 27 '13 at 09:58
Blank
Liam Dolman
182 points

Your Answer

  • Bold
  • Italic
  • • Bullets
  • 1. Numbers
  • Quote
Not the answer you're looking for? Ask your own question or browse other questions in these topics:

Payments