PCI DSS Certification

This translation was generated automatically.

For a new version of the Undsoversum shop, if all goes well, I’ll be able to accept credit card payments directly instead of routing them through PayPal. The API is provided by Paymill.

To play in the fun world of credit cards, you have to be PCI DSS compliant: either don’t store card data yourself, or follow the security rules if you do. Paymill takes care of that for me. Now I just have to tell Security Research & Consulting GmbH that this is really the case. To do so, I need to:

Enter my merchant ID for my acquirer, Lufthansa AirPlus Servicekarten GmbH, into the OSSP from SRC Bonn and answer a few questions. Please click those two links and admire the design.

That generates a 12-page RTF (yes, RTF, not PDF) form: Self-Assessment Questionnaire A and a Certificate of Compliance. Exactly what you’d expect.

The form applies to: “All functions involving cardholder data have been outsourced. No electronic storage, processing, or transmission of cardholder data.”

Across those 12 pages, I’m asked whether all my storage media—which don’t contain any card data—are secure. Are there log files? Are printouts shredded? Do containers have locks? Is there an information security policy for my staff to protect the card data that doesn’t exist?

And this is only the procedure for when I do not store credit card data.