Question

I’ve tried sifting through all the discussions online about PCI compliance when using PayPal payments pro, but there’s no clear answer. Other than having SSL, since I’m not storing cardholder information (I’m only transmitting it), what do I need to do to be pci compliant? I’ve implemented direct payment, express checkout, and recurring billing.

Answer 1

PCI compliance is determined by passing a PCI audit. A service can advertise itself as PCI compliant only if it’s passed the initial audit and any periodic audits.

Any service can adhere to the PCI guidelines – and should – but adherence and compliance are two different things.

A more direct answer to the question:

PayPal stores and manages all customer payment information so they shoulder the majority of the burden that comes with adhering to the PCI guidelines. In your case, at a minimum you should:

1. Make sure that no financial data is stored on your server (not even in a session cookie).
2. Collect customer data and transmit it to PayPal in a secure manner. This usually means using SSL for all customer financial data transmitted to your server, and when re-transmitting this data to PayPal’s API.
3. Keep your software/infrastructure up to date to protect against zero-day exploits and other vulnerabilities.