I've been using 1and1 hosting for a while now and overall I am satisfied with their level of support and the ease of use of their admin panel.
However, I'm going to be branching out from just doing my PC repair stuff into doing some e-commerce... In order to process credit cards using PayPal's pro, I need a PCI compliant host, and I'm trying to price out my options. Does anyone have some links they would like to share?
I investigated the PCI compliance process for my small non-profit a few months back. At this point, the PCI compliance process is a sham. It is neigh impossible for any small business to comply with the PCI certification process, using a PCI compliant datacenter or not.
What it comes down to is that the credit card industry is trying to can the beast that has been growing the past 30 years. The PCI compliance process is meant to force businesses to use major credit card processors to process any credit card transaction, making sure any credit card information is never in the end-merchant's hands (or computers).
The way the PayPal PayflowPro process works, is that your customer places an order on your website, then they are forwarded to PayPal's payment webpage (customized to your liking) to actually enter the payment, then the gateway sends back an 'OK' to your site, saying that the payment was processed.
This differs from what happened in the past, which is they would enter the credit card information on your site, then you passed that information to a merchant gateway, which then gave your site the OK. There are other merchant processors that do this same thing, such as authorize.net and Google Payments.
This change means that your website, and hosted server, does not need to be PCI compliant since credit card information never passes through it. Hopefully this doesn't come across as a rant, but the way they have been implementing PCI and 'scaring' customers with PCI compliance, and charging fees along the way, has been a joke.
You'll find plenty of companies willing to sell you PCI compliance services (even on this website) but in my opinion it is merely snakeoil.
@Christopher
I totally agree with you. I was scared into closing shop on a store I hadn't even opened yet! Until I looked at the PCI Compliance website (https://www.pcisecuritystandards.org/index.shtml) myself. I was disgusted at how big companies have scared small businesses into paying for these PCI Compliance solutions. PCI Compliance is not a law(http://www.pcicomplianceguide.org/pcifaqs.php#23) but in one state (Massachusetts) and there are no other states actively pushing toward laws for PCI Compliance. On top of that, there is a simple 12 step checklist to ensure PCI Compliance. Among them is no storing of credit card information, having a firewall on the server, etc. There are hosting solutions that provide firewalls and security software on the servers for free. Also, you are right, if you are using a payment service provider it's their job to PCI compliant as long as no card info is processed or stored on your site. The fees and jailtime people have been using to scare small business only apply if a customer was compromised due to a violation on your part. As stated on the official PCI DSS website (https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml), a merchant can follow these following steps to be considered PCI Compliant, followed by a self-assesment questionnaire, and a security scan which should always be free:
Requirement 1:
Install and maintain a firewall configuration to protect cardholder data
Requirement 2:
Do not use vendor-supplied defaults for system passwords and other security parameters
Requirement 3:
Protect stored cardholder data
Requirement 4:
Encrypt transmission of cardholder data across open, public networks
Requirement 5:
Use and regularly update anti-virus software
Requirement 6:
Develop and maintain secure systems and applications
Requirement 7:
Restrict access to cardholder data by business need-to-know
Requirement 8:
Assign a unique ID to each person with computer access
Requirement 9:
Restrict physical access to cardholder data
Requirement 10:
Track and monitor all access to network resources and cardholder data
Requirement 11:
Regularly test security systems and processes
Requirement 12:
Maintain a policy that addresses information security
Also, just having a PCI Compliant shopping cart does NOT make a merchant PCI Compliant. PCI Compliance is more of a server/database issue.
I agree. Since the credit card companies are pushing PCI compliance toward law. They should provide the scans and solutions for free. The way I see it, credit card companies have created a new revenue stream for security companies like Norton, McAfee, CA and the list grows. What we don't need here is for them to dictate us into their compliance that is cost prohibitive for the small businesses that we run. After all... it is the small businesses that are generating tons revenue for the credit card behemoths.
So who is really benefiting from the compliance?
Most e-commerce stores are doing their best to take care of security. Now comes the finger pointing sessions. It's the hosting company, it's the banks, it's the credit card behemoths. Reality says it's the crooks hacking our sites. Who is going to make them compliant?
Did I forget to mention lawyers = lobbyists and other will benefit in other ways from this sham. While we get hung out to dry.
Achieving PCI compliance can be costly and time-consuming. The average PCI audit costs between $250,000 to $500,000 to obtain initial compliance according to a March 2010 study conducted by the Ponemon Institute. Many companies fail the audit the first time but by working with a provider who offers PCI hosting solutions you can stay clear from the expenses and audits. The fact is its still expensive and as mentioned its part of the industry standard requirements for security of credit card transactions.
