Spreedly Core - API powered payments w/o burden of PCI compliance
1–10 of 29 posts
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#2I want this so much.
That sounds amazing if true, however the design is not trust inspiring.
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#3I heard about this from the team a few weeks ago, and am excited to take it for a test drive with BCC sometime after my development schedule gets less nuts.
Basically, instead of doing the traditional "send people off to Paypal to pay" routine, you have a form on your site which posts to a Spreedly server. Spreedly then redirects the user to you. You validate the token (similar to catching someone from an OpenID provider) and, if successful, do whatever was required to effect your purchase.
From the user's experience, it sure looks like they were on your site the entire time, but their payment details only ever touch Spreedly's servers. You interface with Spreedly on the backend to do any sort of charging logic that you want -- subscriptions, one-off charges, weird business logic specific to your application, whatever. (This is the main value add over the regular Spreedly subscriptions thing, which works very well if your subscriptions work exactly like Spreedly subscriptions and, apparently, less well otherwise.)
Since the data never touches your servers, you never need to go through PCI compliance work.
The big win I perceive for my business is that my checkout forms will only ask for name, credit card number, and CCV, hopefully increasing conversions versus Google Checkout / Paypal.
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#4I heard about this from the team a few weeks ago, and am excited to take it for a test drive with BCC sometime after my development schedule gets less nuts. Basically, instead of doing the traditional "send people off to Paypal to pay" routine, you have a form on your site which posts to a Spreedly server. Spreedly then redirects the user to you. You validate the token (similar to catching someone from an OpenID prov…
Friendly reminder:
You'll still need your own SSL for your checkout page, even though you're posting to https://spreedly.com
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#5Could we get some indication of what gateways are supported during the beta?
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#6I heard about this from the team a few weeks ago, and am excited to take it for a test drive with BCC sometime after my development schedule gets less nuts. Basically, instead of doing the traditional "send people off to Paypal to pay" routine, you have a form on your site which posts to a Spreedly server. Spreedly then redirects the user to you. You validate the token (similar to catching someone from an OpenID prov…
Friendly reminder: You'll still need your own SSL for your checkout page, even though you're posting to https://spreedly.com
That's what I thought.
I really hope that they make sure and point this out in bold font in all the docs.
Right now I don't see a mention of it anywhere and if people start to use this without SSL on their checkout page, there's going to be big trouble.
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#7I assume that this is from the same people that bring us Spreedly? http://spreedly.com
Or am I wrong?
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#8Your copy needs work. Most importantly, you need to state what Spreedly Core is before the vague marketing gobbet. Even,
"Spreedly Core is . // With Spreedly Core you can focus on who you want to charge when, and we'll take care of the rest. [...]"
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#9I heard about this from the team a few weeks ago, and am excited to take it for a test drive with BCC sometime after my development schedule gets less nuts. Basically, instead of doing the traditional "send people off to Paypal to pay" routine, you have a form on your site which posts to a Spreedly server. Spreedly then redirects the user to you. You validate the token (similar to catching someone from an OpenID prov…
What Spreedly is offering (transparent post to payment processor, redirect back to retailer) is the same as what Braintree is already offering with PCI compliance built in.
That said, we're not happy with Braintree since they messed up an account transfer of ours.
The biggest point I'd like to make is that it sucks once you've got your customers in a recurring plan (Spreedly, Braintree, PayPal, etc). If you're not storing their card numbers, the attrition rate should you choose to change processors is unknown and possibly greatly damaging.
Re: Spreedly Core - API powered payments w/o burden of PCI compliance
#10I heard about this from the team a few weeks ago, and am excited to take it for a test drive with BCC sometime after my development schedule gets less nuts. Basically, instead of doing the traditional "send people off to Paypal to pay" routine, you have a form on your site which posts to a Spreedly server. Spreedly then redirects the user to you. You validate the token (similar to catching someone from an OpenID prov…
> Since the data never touches your servers, you never need to go through PCI compliance work.
Is that actually true? My understanding is that since the HTML form is still served up by your site, you'll still need to go through PCI compliance (although it will be easier with no data stored), since a compromise of your server would compromise card data.