"Does Cartweaver support storing or emailing the customer credit card information so we can process their payment manually?"
With all the attention that PCI compliance, and the liability associated with customer identity theft is getting it amazes me that we still get asked this question, but some clients can be really insistent about wanting to do this, in spite of the risks involved.
In short, the answer is an emphatic no!
We used to say, that you could modify your site to allow this but be sure to get a "hold harmless" agreement from your client before doing so. We no longer say that!!! Reason is, a good attorney can walk right through a hold harmless and still successful hold you liable!
View this topic as the "third rail" of ecommerce development. You touch it, you die! Don't do it, ever. If the client absolutely insists, walk away from the project. Let some other developer enter the food chain for the hungry lawyers out there looking for such cases. This is where you must put on your consultant's hat and educate you client on the gravity of what they are contemplating and help them see that this is just to dangerous and could cost them their business.
As developers, out number one priority should be, like doctors... to "do no harm" and to protect our clients, even in spite of them selves if necessary. Making sure that every possible effort is taken to protect the customer data is the only way to go. Offering our clients the ability to join the vast opportunities of ecommerce is a very valuable service, one that should be taken seriously, protecting our clients and their customers is the foremost concern in offering this service.
Simply put: Secure your site, Secure your server, secure your data.
You, and your clients will be much better for it!
Lawrence Cramer
Cartweaver.com
Stay updated:
http://www.facebook.com/Cartweaver
http://www.twitter.com/Cartweaver
http://blog.cartweaver.com
With all the attention that PCI compliance, and the liability associated with customer identity theft is getting it amazes me that we still get asked this question, but some clients can be really insistent about wanting to do this, in spite of the risks involved.
In short, the answer is an emphatic no!
We used to say, that you could modify your site to allow this but be sure to get a "hold harmless" agreement from your client before doing so. We no longer say that!!! Reason is, a good attorney can walk right through a hold harmless and still successful hold you liable!
View this topic as the "third rail" of ecommerce development. You touch it, you die! Don't do it, ever. If the client absolutely insists, walk away from the project. Let some other developer enter the food chain for the hungry lawyers out there looking for such cases. This is where you must put on your consultant's hat and educate you client on the gravity of what they are contemplating and help them see that this is just to dangerous and could cost them their business.
As developers, out number one priority should be, like doctors... to "do no harm" and to protect our clients, even in spite of them selves if necessary. Making sure that every possible effort is taken to protect the customer data is the only way to go. Offering our clients the ability to join the vast opportunities of ecommerce is a very valuable service, one that should be taken seriously, protecting our clients and their customers is the foremost concern in offering this service.
Simply put: Secure your site, Secure your server, secure your data.
You, and your clients will be much better for it!
Lawrence Cramer
Cartweaver.com
Stay updated:
http://www.facebook.com/Cartweaver
http://www.twitter.com/Cartweaver
http://blog.cartweaver.com