isaachall

PCI compliance is about maintaining a secure network, transmitting information securely, logging access in case of a breach, and access controls. Recurly.js minimizes your compliance scope because the sensitive data does not pass thru your network.

You are still required to maintain a secure network so that malicious code does not end up on your site. This means protecting your site from cross-site scripting. If your site is running untrusted Javascript code, your users could end up being redirected to a phishing site regardless of how you implement your order form (including linking offsite to a hosted page). As long as your server is secure, Recurly.js is secure.

The one scenario that is being pointed out here is from a malicious merchant. We work to make it easier for a merchant to be PCI compliant. If they are malicious and want to defraud their own customers, there are easier ways to post the credit card numbers straight to your server without our software.

With Recurly.js and our Transparent Post, merchants only need to fill out the Self Assessment Questionnaire A.

We launched our own Transparent Post back in March 2011. We created Recurly.js to simplify performing client-side validation, pricing calculations (w/ coupons, VAT, add-ons), and proper error handling when a transaction is declined. It's 10x easier to implement than Transparent Post, and has a much better user experience for the customer.

The Recurly.js library dramatically reduces PCI compliance scope because the sensitive cardholder data does not pass thru your servers. There's a lot of additional PCI compliance issues when the credit card numbers pass thru your server, even if it only resides in memory during the request. Instead, the data is sent directly from the web browser to Recurly, who is PCI Level 1 Compliant.

Obviously, you still have to maintain a secure web server regardless of how you collect payments. That means protecting your users from cross site scripting.

Braintree is great for bringing this issue to light. I've personally been hurt by the lack of portability and have seen it affect several other companies. Here is Recurly's response:

http://blog.recurly.com/2010/05/credit-card-portability/

Just to clarify, we at Recurly will gladly return your credit card data to you (in a secure fashion) if you decide to migrate away. I've been burned before by Authorize.NET holding my business' credit card data hostage and I wouldn't wish that on anyone. We'll be posting more on this shortly.

I'm really happy that Braintree is pushing this forward. I've seen it hurt several companies when they need to switch gateways or merchant accounts.

Isaac Recurly, CEO