Thank you Richard and yes I should force HTTPS.<br><br><div class="gmail_quote">On 22 March 2012 12:30, Richard Taylor <span dir="ltr"><<a href="mailto:richard@richt.co.uk">richard@richt.co.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF"><div>The form posts to spreedly secure (and PCI compliant) servers so the data never 'travels through' your servers so you have limited PCI scope.<br><br>However, as has been mentioned, you will still have to fill out the basic PCI self-assessment questionnaire (which is basically a declaration that the card holder data isn't transferred through or ever stored on your servers).<br>
<br>You should however run the page that contains the form on your server over HTTPS for customer confidence.</div><span class="HOEnZb"><font color="#888888"><div><br>Richard</div></font></span><div><div class="h5"><div><br>
On 22 Mar 2012, at 11:16, Riccardo Tacconi <<a href="mailto:rtacconi@gmail.com" target="_blank">rtacconi@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>So I am using Spreedly Core with Sage Pay as gateway. With Spreedly I have created a form where the user enters the card details and then he is sent to Spreedly to store the data and he is sent back to my app with token so I can do the transaction. Two stakeholders raise an issue because the users will enter their card details in a form, and by only doing that it binds us to deal with PCI. Spreedly web site says the opposite. I am wondering who is right.<div>
<br><div class="gmail_quote">On 21 March 2012 23:29, Graham Ashton <span dir="ltr"><<a href="mailto:graham@effectif.com" target="_blank">graham@effectif.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On 21 Mar 2012, at 22:11, Adrian Sevitz wrote:<br>
<br>
> Most of our customers are non UK based so we just absorb the cost there. It's not ideal.<br>
<br>
</div>Okay, thanks Adrian. That does seem to be the most pragmatic approach...<br>
<div><div>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br>
<a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Riccardo Tacconi<br>Ruby on Rails and PHP development - System Administration<br>VIRTUELOGIC LIMITED<br><br><a href="http://github.com/rtacconi" target="_blank">http://github.com/rtacconi</a><br>
<a href="http://riccardotacconi.blogspot.com" target="_blank">http://riccardotacconi.blogspot.com</a><br><a href="http://twitter.com/rtacconi" target="_blank">http://twitter.com/rtacconi</a><br>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Chat mailing list</span><br><span><a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a></span><br>
<span><a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a></span><br></div></blockquote></div></div></div><br>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org">Chat@lists.lrug.org</a><br>
<a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Riccardo Tacconi<br>Ruby on Rails and PHP development - System Administration<br>VIRTUELOGIC LIMITED<br><br><a href="http://github.com/rtacconi" target="_blank">http://github.com/rtacconi</a><br>
<a href="http://riccardotacconi.blogspot.com" target="_blank">http://riccardotacconi.blogspot.com</a><br><a href="http://twitter.com/rtacconi" target="_blank">http://twitter.com/rtacconi</a><br>