I've set up my dev site so that everything is working with ubercart/sagepay and connecting to Sage pay's VSP Simulator.

Looking in to the next steps with Sage pay, I see that I need to set up the Merchant account and sort out PCI DSS compliance. I understand that the ubercart Sage pay module uses the Direct integration method and therefore will need to be PCI DSS compliant, is this the case? If so, should I use the Trustwave solution as recommend by Sage pay?

Additionally are there any concerns with who hosts the site in relation to PCI DSS compliance?

Comments

hanoii’s picture

hanoii
Primary language Spanish
Location 🇦🇷UTC-3
commented

I am not really aware of the PCI DSS standards to answer your question. Module was developed following SagePay PHP guidelines to communicate with their server, but I haven't gone through auditing the code or try to validate it against any standard and neither have plans to do it any time soon. Please feel free to do so if you want/can.

As for your Trustwave question, again, not really know what that solution is really about. And finally about hosting and PCI DSS, once more, I am not sure of the requirements, but I guess first thing you have to be sure is to be provided with an SSL certifcate,

techypaul’s picture

techypaul commented

FYI - It is unlikely you can get PCI DSS compliance with shared hosting, so stay away from that (Virtual server is ok).

greg.harvey’s picture

greg.harvey
Primary language English
Location Occitanie, France
commented

As I understand it, from the end of next month (October 2009) compliance will become obligatory. There is a good guide about PCI DSS compliance with UC generally here:
http://www.ubercart.org/docs/user/2731/credit_card_settings

If you follow those instructions, on a dedicated (or virtual) box with a properly configured firewall and access carefully controlled (e.g. all ports blocked off except for 22, 80 and 443 and login by shared keys only is typical), plus use an SSL certificate, properly configured, using the Secure Pages module to manage which parts of your site and subject to secure connection (I tend to make it user, user/*, admin/* and cart/*) *and* use a gateway (yes, SagePay is fine) then you will be compliant. =)

That's my understanding anyway - someone please correct me if I'm wrong.

eddowding’s picture

eddowding commented

Mostly right, it seems. However note that the compliance date is 30 Sept, not 30 Oct!

http://www.corporate.visa.com/md/nr/press873.jsp

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Active » Closed (works as designed)

Closing this. On a properly configured server, Ubercart and Sage Pay Direct can happily pass PCI DSS compliance.