Ecommerce
Ecommerce
Our tech and design team can build your storefront. Our preferred platform is Magento because it is robust and flexible. You also have the option of using your own platform or storefront. Our custom API integrations will sync directly with your online shopping cart to automatically import orders. Either system will generate an order in our inbox and a pick ticket in the warehouse to get your merchandise out the door.
PCI Compliance
WHY MERCHANTS MUST BE PCI-COMPLIANT
CHANTS MUST BE PCI-COMPLIANT
PCI compliance isn’t an option for merchants who process credit cards and store cardholder
information. The credit card associations require merchants to securely handle this information at-all-times. Merchants who fail to comply with PCI requirements can expect large fines, which can also result in canceling their ability to process payments. PCI compliance requires merchants safeguard their customers’ payment card information. This means following security requirements that include policies and procedures, software design, and network architecture.
HOW MAGENTO HELPS MERCHANTS BE COMPLIANT
- There are two ways in which Magento helps merchants:
First, Magento Commerce (Cloud) is PCI certified as a Level 1 Solution Provider, so any merchants using Magento Commerce (Cloud) can use Magento’s PCI Attestation of Compliance to aid their own PCI certification process.
Second, Magento makes PCI compliance easier by offering integrated payment gateways that allow merchants to securely transmit credit card data via direct post API methods or with hosted payment forms provided by the payment gateway and integrated with the merchant’s checkout pages. The Direct Post method allows for information to be sent directly to the payment gateway without sensitive data flowing through or stored on the Magento application server. The Hosted payment forms allow merchants to offer a seamless checkout as well by integrating the payment forms into checkout but with the form hosted by the payment gateway rather than by the Magento application server. By keeping sensitive data outside of the Magento Application server, this enables updates to the core Magento eCommerce application with new marketing, merchandising and content management capabilities, without having to go through PCI compliance re-assessment of the entire Magento eCommerce platform. As a result of these integration options, Magento merchants are able to validate for compliance via self-assessment at the SAQ A or SAQ A-EP level rather than the more difficult SAQ D level.
ABOUT PCI COMPLIANCE
The major credit card companies created the PCI Data Security Standard (PCI DSS) to make sure merchants adopt critical security measures. There are 12 requirements for meeting the PCI DSS, broken into 6 groups:
Build and Maintain a Secure Network
REQUIREMENT 1: Install and maintain a firewall configuration to protect cardholder data
REQUIREMENT 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
REQUIREMENT 3: Protect stored cardholder data
REQUIREMENT 4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
REQUIREMENT 5: Use and regularly update anti-virus software
REQUIREMENT 6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures
REQUIREMENT 7: Restrict access to cardholder data by business need-to-know
REQUIREMENT 8: Assign a unique ID to each person with computer access
REQUIREMENT 9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks
REQUIREMENT 10: Track and monitor all access to network resources and cardholder data
REQUIREMENT 11: Regularly test security systems and processes
Maintain an Information Security Policy
REQUIREMENT 12: Maintain a policy that addresses information security
Ecommerce
Our tech and design team can build your storefront. Our preferred platform is Magento because it is robust and flexible. You also have the option of using your own platform or storefront. Our custom API integrations will sync directly with your online shopping cart to automatically import orders. Either system will generate an order in our inbox and a pick ticket in the warehouse to get your merchandise out the door.
PCI Compliance
WHY MERCHANTS MUST BE PCI-COMPLIANT
HOW MAGENTO HELPS MERCHANTS BE COMPLIANT
- There are two ways in which Magento helps merchants:
First, Magento Commerce (Cloud) is PCI certified as a Level 1 Solution Provider, so any merchants using Magento Commerce (Cloud) can use Magento’s PCI Attestation of Compliance to aid their own PCI certification process.
Second, Magento makes PCI compliance easier by offering integrated payment gateways that allow merchants to securely transmit credit card data via direct post API methods or with hosted payment forms provided by the payment gateway and integrated with the merchant’s checkout pages. The Direct Post method allows for information to be sent directly to the payment gateway without sensitive data flowing through or stored on the Magento application server. The Hosted payment forms allow merchants to offer a seamless checkout as well by integrating the payment forms into checkout but with the form hosted by the payment gateway rather than by the Magento application server. By keeping sensitive data outside of the Magento Application server, this enables updates to the core Magento eCommerce application with new marketing, merchandising and content management capabilities, without having to go through PCI compliance re-assessment of the entire Magento eCommerce platform. As a result of these integration options, Magento merchants are able to validate for compliance via self-assessment at the SAQ A or SAQ A-EP level rather than the more difficult SAQ D level.
ABOUT PCI COMPLIANCE
The major credit card companies created the PCI Data Security Standard (PCI DSS) to make sure merchants adopt critical security measures. There are 12 requirements for meeting the PCI DSS, broken into 6 groups:
Build and Maintain a Secure Network
REQUIREMENT 1: Install and maintain a firewall configuration to protect cardholder data
REQUIREMENT 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
REQUIREMENT 3: Protect stored cardholder data
REQUIREMENT 4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
REQUIREMENT 5: Use and regularly update anti-virus software
REQUIREMENT 6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures
REQUIREMENT 7: Restrict access to cardholder data by business need-to-know
REQUIREMENT 8: Assign a unique ID to each person with computer access
REQUIREMENT 9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks
REQUIREMENT 10: Track and monitor all access to network resources and cardholder data
REQUIREMENT 11: Regularly test security systems and processes
Maintain an Information Security Policy
REQUIREMENT 12: Maintain a policy that addresses information security