Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are lean startups easily accepting CC payments?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 125 posts

Re: Ask HN: How are lean startups easily accepting CC payments?

#101

Post by rkalla »

tzs wrote: post #85
tzs wrote: post #84

Earlier quoted context omitted.

You get billed by your PAYMENT GATEWAY and your ACQUIRING BANK. (Open question: if you got your MERCHANT ACCOUNT through an ISO/MSP, I am not sure if you are billed directly by your ACQUIRING BANK, or if your bills will come from your ISO/MSP). For pretty much all practical purposes, these are the only entities you directly care about, I think. Here's what I've gathered is the actual flow of a payment. It is possible…

Now let us talk about recurring billing. I have not used any recurring billing service, so can't comment on how those work, but here are some thoughts on handling it yourself. First, there is the obvious way. Store credit cards yourself, and then you can run new transactions through when it is time to re-bill someone. You don't want to do this. This gets you all the way into the PCI cesspool. In fact, if you are a si…

tzs, your write (tomb) was unbelievably helpful... just finished reading all of it.

As you walked through all the examples I was slowly leaning towards BrainTree and as you kept going through the reasoning I felt like I concluded at the same place you did by the end; sounds like the perfect thing to launch with and if I want better sub handling I can always add something like Recurly later.

I have no love for merchant account banks after reading all that.

I had no idea where the "points" on reward cards were coming from, very sneaky!

Fascinating read, I can't imagine how long it took to write up. I really appreciate that.

Re: Ask HN: How are lean startups easily accepting CC payments?

#102

Post by rkalla »

tgriesser wrote: post #48

Braintree is great, the API, docs, and client libraries are all great. I'm using it for a subscription based product and couldn't be happier with the choice, even if the minimum fees are a little higher than most, if you aren't going to be able to cover a $75 minimum per month then you probably have bigger issues with your business plan than your payments provider. The fact that they give data portability is great an…

Are you processing any international charges with BrainTree? In tsz's post he mentioned that they don't help with that until you are doing serious volume of sales and then they will handle international charges for you.

Re: Ask HN: How are lean startups easily accepting CC payments?

#103

Post by rahoulb »

kwis wrote: post #93
rahoulb wrote: post #87

Earlier quoted context omitted.

Do the credit card numbers ever travel via your server? Even temporarily in memory? If so you are liable for PCI-DSS section C, which is a LOT of hoops to jump through. Spreedly saves you from that.

It took us a couple hours to be in compliance with section C. If memory serves, we dealt with a vendor who did a scan, made us install AV software on our Linux boxes, and one or two other minor process adjustments. It wasn't a big deal. Given Spreedly's current prices of the lesser of $0.20/transaction or 2%/transaction, this minute quantity of work is currently providing us with a return of approximately $12,000/mo.…

As I understood it you have to have written procedures and policies, with fully secure change control and logging for section C ?!?

Re: Ask HN: How are lean startups easily accepting CC payments?

#104

Post by tgriesser »

rkalla wrote: post #102
tgriesser wrote: post #48

Braintree is great, the API, docs, and client libraries are all great. I'm using it for a subscription based product and couldn't be happier with the choice, even if the minimum fees are a little higher than most, if you aren't going to be able to cover a $75 minimum per month then you probably have bigger issues with your business plan than your payments provider. The fact that they give data portability is great an…

Are you processing any international charges with BrainTree? In tsz's post he mentioned that they don't help with that until you are doing serious volume of sales and then they will handle international charges for you.

No, no international charges with BrainTree and none in the foreseeable future. If that is a concern then it might be good to look at other options, I'd assume you'll face similar difficulties with other processors (I could be wrong).

Re: Ask HN: How are lean startups easily accepting CC payments?

#105

Post by kwis »

rahoulb wrote: post #103
kwis wrote: post #93

Earlier quoted context omitted.

It took us a couple hours to be in compliance with section C. If memory serves, we dealt with a vendor who did a scan, made us install AV software on our Linux boxes, and one or two other minor process adjustments. It wasn't a big deal. Given Spreedly's current prices of the lesser of $0.20/transaction or 2%/transaction, this minute quantity of work is currently providing us with a return of approximately $12,000/mo.…

As I understood it you have to have written procedures and policies, with fully secure change control and logging for section C ?!?

You need a written security policy, but that was pretty close to pro forma. The compliance firm wrote us one which we disseminated appropriately.

You basically just need to follow some reasonable security standards. Firewalls, ssh/ssl admin terminals, no shared credentials, and then follow a basic security policy.

Re: Ask HN: How are lean startups easily accepting CC payments?

#106

Post by tzs »

rkalla wrote: post #101
tzs wrote: post #85

Earlier quoted context omitted.

Now let us talk about recurring billing. I have not used any recurring billing service, so can't comment on how those work, but here are some thoughts on handling it yourself. First, there is the obvious way. Store credit cards yourself, and then you can run new transactions through when it is time to re-bill someone. You don't want to do this. This gets you all the way into the PCI cesspool. In fact, if you are a si…

tzs, your write (tomb) was unbelievably helpful... just finished reading all of it. As you walked through all the examples I was slowly leaning towards BrainTree and as you kept going through the reasoning I felt like I concluded at the same place you did by the end; sounds like the perfect thing to launch with and if I want better sub handling I can always add something like Recurly later. I have no love for merchan…

I'm glad it helped. Keep in mind that I don't know if I have it right. I marked several open questions, and I probably missed many. I'm still hoping someone with better information will offer corrections.

Re: Ask HN: How are lean startups easily accepting CC payments?

#107

Post by dataminer »

qeorge wrote: post #45

Horror stories you may have heard aside, I've setup PayPal's website payments pro for many clients, with tremendous success. Never had any trouble with them, and my PayPal rep has always been reachable by phone and very helpful. Additionally, I've used their recurring payments product (extra $30/month tacked on to Website Payments Pro). Its also really easy. You just send the transaction ID from a previous payment in…

Does Paypal website payments pro offer transparent redirect like Braintree?

Re: Ask HN: How are lean startups easily accepting CC payments?

#108

Post by dangrossman »

rkalla wrote: post #100
dangrossman wrote: post #73

Earlier quoted context omitted.

It doesn't take much to improve the billing experience over sending someone to an external website, to pay with payment pages that are minimally customizable to match your site. You lose the ability to tweak and test one of the most important parts of the customer acquisition experience. There's a >10% conversion rate gap between different checkout flows I've tested on one of my ecommerce sites. I've written my own s…

dan, because you are holding the CC information on your site and POST'ing it out to external services at authorize.net, did you have to do any work for the "PCI" compliant/privacy stuff I see? I read a few posts on forums that if the customer financial data is ever on a page you wrote, you come under the realm of at least some PCI compliance because of a possible XSS attack getting that information out of your forms.…

You're right, doing it yourself requires PCI compliance. I've done all that work and my servers get a compliance scan every quarter. That's just tangential to patio's argument (that it's technically difficult to offer a better billing experience than an outsourced service).

Thing is, everything PCIDSS says you have to do when payment data passes through your servers is security 101. If you're not already doing 90% of these things, you're just waiting to be hacked anyway. Instead of thinking of it as a burden for payment processing, think of it as something every professional online business should have been doing anyway.

Re: Ask HN: How are lean startups easily accepting CC payments?

#109

Post by MBlume »

We're using Braintree here at Loggly, and like it quite a lot. The API has a neat little Python library that we use on our backend, and is pretty well documented.

The indirection involved in posting billing forms to them means you wind up doing some interesting gymnastics if you want to include a billing form as part of a larger user signup form. You may want to check the JS on our paid signup page -- go to https://www.loggly.com/register/#woodpecker do an inspect element on the submit button, and expand the inline script a few lines down. The script creates an (unfunded, inactive) user on the server, receives a token pointing to this user to use in posting to braintree, and then posts the braintree form.

Re: Ask HN: How are lean startups easily accepting CC payments?

#110

Post by rkalla »

MBlume wrote: post #109

We're using Braintree here at Loggly, and like it quite a lot. The API has a neat little Python library that we use on our backend, and is pretty well documented. The indirection involved in posting billing forms to them means you wind up doing some interesting gymnastics if you want to include a billing form as part of a larger user signup form. You may want to check the JS on our paid signup page -- go to https://w…

Thank you for the heads up on the technical aspects of integration. Will take a peek at the JS.
Post reply on HN