2

I'm building a web app for a client and I'm looking to host with someone like Media Temple. I will manage the server and everything, but the client pays for the hosting with his credit card.

The problem is he will have to enter his credit card details and I will have access to it any time I log into the control panel to manage the server.

Is it just a matter of trust, or is this set-up inappropriate?

3 Answers 3

10

Every web credit-card interface I've ever seen masks most of the card number when reviewing my account. No one (not even me) can see all of the credit card number. He's going to have to just trust you on the CC dates and last 4 digits.

If the hosting provider allows anyone (even the customer) to see the entire credit card number, then they have a problem and you shouldn't use them. In all likelyhood they are violating their payment processor's rules - generally you can't ever show the credit card number.

2

If you're hosting credit card information for a transaction your processor company has rules you have to follow that dictate how the card number is handled; as I understand it the number isn't kept any longer than absolutely necessary and is never revealed to anyone, like Micheal said. You can be held liable if the number is intercepted or stolen because you allowed it to be transferred or held (or stolen) in cleartext. In general you don't WANT a consumer's credit card number because of the liability you can incur and other legal hassles if you violate rules in handling the number.

If I understand the question correctly you might seriously want to consider either paying the hosting yourself and billing the client on behalf of the provider or find a way to host it in a way that you won't have access to the number (that depends on the hosting provider's options available) or set up a way for the client to automatically pull payment from a dedicated account from his bank automatically or something like that, something that limits your liability should the card number be stolen. If something flaky happens to that credit card and you had access to it (or someone hacked your account and gained access), you become suspect number one.

Personally I'd find it strange that the provider allows the credit card number to be fully displayed. Everywhere I've used will show the last few digits and that's it, just in case something happens where someone gains access to the account.

0

Do not have the client pay for the server. You pay for the server and invoice the client for the same dollar amount - or become a reseller and mark it up to make some margin..

Not the answer you're looking for? Browse other questions tagged .