Shared Hosting Versus Dedicated Hosting

No online store with on-site processing that is hosted in an inexpensive shared or "virtual" hosting environment will be able to pass PCI standards. You must control your server and all the programs on it.

Dedicated servers that you can control yourself are becoming cheaper all the time, but they still go for a minimum of $100 per month with $200-250 being more common. You also need to have the technical knowledge to maintain your own server. You don't have a technical support team to call on if your server goes down, because you are the technical support team.

For these reasons, it is most economical for most small businesses to outsource their payment processing and keep their Web sites at a low-cost virtual host.

Here we will review a few of the off-site processors for the many open-source commerce programs.

Offsite Processing for CRE Loaded, osCommerce and More

CRE Secure is the newest off-site credit card processor. Released just this year, it is built into all new CRE Loaded 6.4 stores, dubbed CRE PCI stores. A separate module is designed to be used with CRE Loaded stores in all versions including 6.15, 6.2 and 6.3.

There is also a CRE Secure Payment Module available for osCommerce, and the company plans to release more modules for other open-source commerce stores as they become available.

According to the manufacturer, "When used as directed, this payment module will take your site out of scope for PCI Requirements." This is because the Web host that they use, GSI Hosting, is the first managed-service provider in the world to obtain certification from Visa for their PCI DSS compliance and physical security.

CRE Secure Advantage

The advantage that CRE Secure has over the other offsite processors is that the customer does not visibly see that they have been moved from your online store to a third-party location for processing. This is because the CRE Clone technology effectively copies your store's header, footer and stylesheet to make it look just like your store.

The company does require additional steps during and after installation, including a new or existing valid SSL Certificate, and during installation you must purge or mask any existing credit card information in your existing store.

Standard gateway fees apply, and the fees vary depending on the merchant account you open. Integrated processors include First Data, Global Payments, Elavon, TSys, Chase PaymentTech and JetPay.

PayPal

PayPal has been in the off-site credit card processing business since 1998 and owned by eBay since 2002. Its PCI compliant programs include PayPal Website Payments Standard, E-mail Payments and Payflow Link. These programs do not allow you to customize the checkout experience, and it is clear to the customer that they have left your site to make the payment transaction.

If you use PayPal's Website Payments Pro, Payflow Pro or Virtual Terminal, you can semi-customize the look and feel of the checkout experience, but you must also use the company’s free guide to help ensure that your online store is PCI compliant. The guide deals with PCI disclosure requirements including a business description, privacy policy, shipping policy, return policy and contact information.

PayPal has transaction fees of 1.9 to 2.9 percent plus $0.30 per transaction.

2CheckOut

Established in 2000, 2CheckOut has a unique business model where each time a customer checks out of your store, 2CheckOut buys the product from you and resells it to the customer. The customer's credit card statement shows a purchase from "2CheckOut" and not your store's name. 2Checkout has invested resources into additional security technologies, training personnel and audits so you do not have to worry about it. You have only one customer — 2CheckOut.

2CheckOut charges a $49 one-time sign up fee plus 5.5 percent of the sale amount and $0.45 per transaction.

Kerry Watson is a regular contributor to ECommerce-Guide.com, as well as a consultant and author of 14 books in the OSC industry including the newly updated CRE Loaded User Manual for All Versions.