Hello, I recently purchased amember and am in the process of setting it up. All of the payment plugins say they are in beta or aren't PA-DSS certified (Authorize.net) What processor do you recommend? Authorize.net is my preferred processor since I already have a relationship with one of their resellers. Does the PA-DSS warning mean I cannot use them? I do not want to store any sensitive customer data on my servers. I appreciate the help and LOVE aMember!
You are not storing the credit card on your servers and communicating to Authorize.NET securely so I believe it is not an issue (I use Authorize.NET as my primary).. Here are the compliance rules or PA-DSS (checked are the ones I believe aMember 4 has today) 1. Do not retain full magnetic stripe, card validation, code or value, or PIN block data. 2. Protect stored cardholder data. 3. Provide secure authentication features. 4. Log payment application activity. 5. Develop secure payment applications. 6. Protect wireless transmissions. NOT APPLICABLE 7. Test payment applications to address vulnerabilities. 8. Facilitate secure network implementation. 9. Cardholder data must never be stored on a server connected to the internet. NOT SURE ABOUT THIS ONE? Is Card Holder name or email or address "Cardholder data" if so then aMember will NEVER be compliant. 10. Facilitate secure remote software updates. 11. Facilitate secure remote access to payment application. 12. Encrypt sensitive traffic over public networks. 13. Encrypt all non-console administrative access. 14. Maintain instructional documentation and training programs for customers, resellers, and integrators. So the only thing that jumps out for me is the "not storing cardholder data on the server connected to the internet". aMember does not store the credit card # (only last 4 digits).. If it is a requirement to not store ANY cardholder data on a server connected to the internet I'm not sure that any online commerce site can be compliant.