Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone know if Rails 3.0 passes PCI compliance scans?

share|improve this question
up vote 6 down vote accepted

Frameworks that are used are not the issue, it the applications that are built on the framework. So essentially PCI is framework - rails in this case - agnostic.

Just make sure you code a secure app using rails and you will be fine.

share|improve this answer

I suspect that depends deeply on how you write your application on top.
I could write an application that didn't store credit card data encrypted, or was otherwise filled with security holes, and then it wouldn't be PCI-DSS compliant, regardless of the framework underneath.

share|improve this answer
Right, how an application is handling the data definitely influences compliance. I'm concerned about the language / framework specific DSS scan results (for example, PHP 5.2.X is regarded as non-compliant by most scanners). – Brian Oct 15 '10 at 16:55
Yes, but the point is, no matter how secure a framework, if you've got a shite application on top, then it might as well be PHP 5.2.x – Tom O'Connor Oct 15 '10 at 17:02
You're preaching to the choir, I agree with you. – Brian Oct 15 '10 at 17:08
@Brian Oh, sorry.. I generally find that people are disagreeing with me :P – Tom O'Connor Oct 15 '10 at 19:40

I'm not sure about Rails 3.0 specifically, but the majority of Braintree's payment gateway is using Rails 2.x, and Braintree is a PCI compliant service provider.

share|improve this answer
I wonder if they're using – ceejayoz Dec 3 '13 at 22:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.