X-Cart:PCI-DSS

About PCI DSS

PCI DSS stands for Payment Card Industry Data Security Standard, which is a worldwide information security standard assembled by the major credit card vendors, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa, Inc. The standard was designed to help organizations involved in processing credit card payments online make their payment systems secure from cardholder data fraud.

PCI DSS specifies 12 requirements for compliance that apply both to hardware and software parts of the system that is used to collect, store, transmit and process valuable credit card data as well as the human factor.

Simplifying PCI DSS compliance

Bringing the whole system into full PCI DSS compliance is rather a resource-consuming task that can hardly be completely implemented by small and medium businesses because it stipulates that the compliance must cover all components of the system. This gives rise to a common misconception about PCI DSS that is that the requirements must be met across all applications in the payment transaction flow without exception. In reality, the standard only applies to the components that store, transmit and process cardholder data, and is not applicable to other components if they are logically isolated. Therefore, a common practice is to take a web store itself out of PCI DSS scope (i.e. do not allow it to collect, store and transmit cardholder data) and arrange certified third-party services and providers that do have adequate resources to ensure full PCI DSS compliance of their products and services: compliant hosting provider, compliant payment application and payment gateway, etc.

Does X-Cart comply to PCI DSS?

Due to its complex and extensive architecture, X-Cart is not going to qualify for PCI DSS compliance. This would significantly slow down the software production and improvement as each new release and update would require recurring certification. Another reason for not certifying X-Cart is that the software is delivered with 100% open code (i.e. is fully customized) and a great amount of third-party add-on modules that are always a matter of potential vulnerabilities and back doors.

Instead, X-Cart 4.3.x is integrated with the X-Payments payment application, which has qualified for PCI DSS compliance. X-Payments can safely collect, store and transmit cardholder data to a payment gateway and does not use X-Cart resources. Besides, the compact and virtually closed architecture of X-Payments reduces a chance of a bug and makes it impossible to hack into the module through a companion application, including X-Cart.

Thus, to ensure PCI DSS compliance of an X-Cart based store you need to use it together with the X-Payments application as well as configure X-Cart in a way that will take X-Cart out of PCI DSS scope.

Important: Bringing X-Cart into compliance with PCI DSS does not make your web store fully compliant. And you must make sure that other components of your system that collects, stores, transmits and processes valuable credit card data comply with the standard's requirements.

Configuring X-Cart to meet PCI DSS

Follow the steps below to when implementing X-Cart in a PCI compliant manner.

1. Collecting credit card data

If forced, X-Cart can collect customers' credit card details during registration. This functionality is controlled via two check boxes in the section General Settings / General Options of the Admin area:

• Do not ask customers to enter CC information while getting registered: Defines if a customer will be asked to provide credit card details during registration;
• Display CVV2 input box on the registration form and at the last stage of checkout if Manual CC processing is used...: Defines if a customer will be asked to provide CVV2 during registration.

Asking for credit card data during registration must be disabled as shown in the picture below.

2. Storing credit card data in X-Cart database

If forced, X-Cart can store valuable credit card data in an encrypted database. This functionality is controlled via three variables in the main configuration file <xcart_dir>/config.php. You must set the value of all the three variables to false (which is the default setting), and no credit card will be stored in the X-Cart database then.

# file <xcart_dir>/config.php

$store_cc = false
$store_ch = false
$store_cvv2 = false

3. Removing historical data

Removing historical data, such as card validation codes and other credit card information after the orders using it have been processed and completed, is absolutely necessary for PCI DSS compliance. To remove this data use the Summary > Tools section of X-Cart admin back-end.

4. Using background payment methods

With a background payment method, customers input their credit card data on the side of X-Cart at the final step of checkout. Since X-Cart itself is taken out of PCI DSS scope and does not comply to PCI DSS requirements, you must disable all background payment methods in your store. This does not really mean that you will not be able to use background payment methods to accept payments online: an interface to use such methods is now fully supported by X-Payments, which is PCI DSS compliant.

To disable background payment methods, use the Payment methods section of the X-Cart Admin area (Settings menu -> Payment methods).

5. Using Subscriptions module

When the built-in X-Cart module Subscriptions is enabled, X-Cart keeps credit card data in its database, which is prohibited by PCI DSS. To take X-Cart out of PCI DSS scope completely, you must disable the module. To disable the module:

1. Log in to the X-Cart Admin area.
2. Go to the section Modules (Administration module -> Modules)
3. Deselect the check box for the entry X-Payments Connector.
4. Click the Update button at the bottom of the page to save the changes.