Safe place to store credit card numbers?

I'll play the bad guy/other side.

I am unsure of these and their pricing structures in the US/other countries, but in Canada, Square and Stripe are more expensive than a standalone unit at the discount rate. It is something you'll need to evaluate and determine if it is in your best interest. In some instances, these "simple" platforms can go a long way against the cost factor.

From the Church's standpoint, the extra 1% (Or less because the manual entry discount is so high), the additional amount would be well worth the insurance of not having catastrophic problems. I was also thinking about this; The Church sounds like they are doing almost exclusively manual entry, which I would figure at some point the processor will not like the risk. One chargeback and it is possible the Church would be clamouring for a new processor or unable to get a new one.

Some other benefits are the POS system of Square as well easy integration of Stripe without a ton of code, which could be a much cheaper alternative than others.

However, if you do any volume, you will find very fast that 1%+ is a lot of cash flying out the door.

Sure, you're not trying to estimate your actual rate so that it can be much simpler to budget/plan with a fixed rate, but in most cases, if you're pushing any volume, old terminal-style terminals can be more economical.

Use my terminal as an example. I re-worked it out based on my average discount rate, and if I sell more than $1200 a month onto a credit card, the older style is cheaper. I don't have to worry about if a customer drops my reader (My rental also covers any damage as long as it wasn't caused by gross negligence or a part of a crime. I've had a few customers bounce my terminal.)

Remember, old style processors, your discount is variable on the type of card used - You are paying for that farmer for the Air Miles for their 3rd trip around the world this year. You're still paying that trip for them with Square/Stripe/etc, you just don't see it.

I did keep my Square active however because
  • Black/unlimited cards. Their discount rates often creep above the 3% (And yes I got good at knowing)
  • Main processor down or internet down (Didn't have to mess with tethering or lose a sale.)
  • Recurring billing module. Great for Domains, Hosting, MSP services, managed antivirus or recurring retainer methods, to name a few
 
If your client inputs the data into Square's system, it's on them. If YOU input the data into Square's system, it's on YOU! Who does the data entry matters.
This is not entirely true.

If you are storing cardholder information in square, and square is breached, nobody is on the hook for that.

If you are storing cardholder data in an excel spreadsheet and OneDrive / google drive / your PC is hacked, then you are on the hook.

Whether you or your client enters the data is irrelevant. If you have a payment form on your website and it uses a plug-in not an inline frame, you would be on the hook if your website had malware that was grabbing cardholder info as it was being entered. Hosted checkouts are much better for that sort of thing.
 
This is not entirely true.

If you are storing cardholder information in square, and square is breached, nobody is on the hook for that.
Just clarifying, technically Square would be on the hook, and if you are questioned on PCI compliance, you can defer them to Square and that you do not capture or store any credit card information, that your vendor does.

 
Just clarifying, technically Square would be on the hook, and if you are questioned on PCI compliance, you can defer them to Square and that you do not capture or store any credit card information, that your vendor does.

Right. Sorry the post I quoted seemed to blame the end user who entered their details, which is what I was responding to.
 
I wonder if @Sky-Knight was intending to blame Square, but you're right, I can see how it could be construed as the card holder. Missed that myself. :)
I was... but with a subtle difference.

If the user puts their data into a screen that has Square branding, they have no real logical means to blame a vendor using Square for crap that happens to Square. I'm sure some Karen on overdrive out there will still do it, but in the liability game shifting that blame is literally the game.

When it comes to PCI compliance however, I'll defer to Visa MC because that's his specialty. The stuff I'm talking about are hard lessons either myself or my clients have learned over the years trying to navigate the regulations and manage customer expectations.

The goal, not to get sued.
 
Back
Top