Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm building a web app for a client and I'm looking to host with someone like Media Temple. I will manage the server and everything, but the client pays for the hosting with his credit card.

The problem is he will have to enter his credit card details and I will have access to it any time I log into the control panel to manage the server.

Is it just a matter of trust, or is this set-up inappropriate?

share|improve this question
add comment

closed as off topic by Mark Henderson Jan 22 '12 at 7:03

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

up vote 10 down vote accepted

Every web credit-card interface I've ever seen masks most of the card number when reviewing my account. No one (not even me) can see all of the credit card number. He's going to have to just trust you on the CC dates and last 4 digits.

If the hosting provider allows anyone (even the customer) to see the entire credit card number, then they have a problem and you shouldn't use them. In all likelyhood they are violating their payment processor's rules - generally you can't ever show the credit card number.

share|improve this answer
add comment

If you're hosting credit card information for a transaction your processor company has rules you have to follow that dictate how the card number is handled; as I understand it the number isn't kept any longer than absolutely necessary and is never revealed to anyone, like Micheal said. You can be held liable if the number is intercepted or stolen because you allowed it to be transferred or held (or stolen) in cleartext. In general you don't WANT a consumer's credit card number because of the liability you can incur and other legal hassles if you violate rules in handling the number.

If I understand the question correctly you might seriously want to consider either paying the hosting yourself and billing the client on behalf of the provider or find a way to host it in a way that you won't have access to the number (that depends on the hosting provider's options available) or set up a way for the client to automatically pull payment from a dedicated account from his bank automatically or something like that, something that limits your liability should the card number be stolen. If something flaky happens to that credit card and you had access to it (or someone hacked your account and gained access), you become suspect number one.

Personally I'd find it strange that the provider allows the credit card number to be fully displayed. Everywhere I've used will show the last few digits and that's it, just in case something happens where someone gains access to the account.

share|improve this answer
add comment

Do not have the client pay for the server. You pay for the server and invoice the client for the same dollar amount - or become a reseller and mark it up to make some margin..

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.