Question

This is more of an inquiry into the technology solutions you are using, but it also relates to security of users credit card information. We are looking for a billing solution for our month-to-month usage based billing (just like for FogBugz On Demand) and are wondering what you use.

Do you use a third party to handle credit card transactions or did you roll your own solution? If you rolled your own, (which appears to be the case), when a user enters credit card information for their FogBugz On Demand account, it must be stored on your servers to bill them again each month. Does this mean you are PCI compliant? What is the risk to users of a security breach with their credit card information?

Answer 1

I recommend checking out Authorize.net. Their standard API is really simple. They also have this API called the Customer Information Manager which allows you to store the card numbers for recurring billing on their servers.