Second that. I am fairly closely involved with a company that does just that and the amount of rules and regulations borders on the draconian. The only thing missing is armed marines in front of the server room access doors.

This is one of those instances where if your volume is < $1,000,000 per annum you probably shouldn't even be thinking about doing your own acceptance of CC data.

Just hand it off, pay a couple of % and get on with doing what you're good at.

Third that. I used to work at a company that processed a high volume of payments. It's a pretty big pain to be PCI compliant, from restricting access to any server that handles payment information, to managing who can access what information. Like the parent said, unless you're doing multi-million dollar business, it's probably not worth it to handle this on your own.

Does the company you're involved with do PCI compliance auditing?

They are a VISA/MC authorized reseller working together with Paysquare in the netherlands, I'm not going to name them because I would not want to recomend any compay that I'm affiliated with, that's too much like advertising on a site like this.

So, no, they don't do the audits themselves but they have been audited several times over the last 8 years, and so far they have passed their audits with flying colours.

The people running that business take it very seriously, they process about 150M$US annually and they have it set up so that every customer has their own merchant account.

This is contrary to most IPSP's that multiplex a single (or several) merchant account(s) across many merchants, which I personally believe is a recipe for disaster. For more information on what can go wrong have a look at 'IBill' and 'DMR'.

This does mean that it is much more expensive to set up a customer but the good news is that it actually is a lasting relationship instead of 'until we get yanked'.

Understandable (avoiding the appearance of advertising). I actually need auditing and was being lazy about shopping around.

tptacek, you're right about life being too short for that BUT in some cases an entity really does need to ensure compliancy.

Just don't get rolled. I can refer you to some reputable companies, if you'd like.

(You weren't asking me, but I may have implied it earlier --- we definitely don't do PCI certification work; life's too short to waste on a bunch of checklists.)