Live data from Hacker News

Ribbon BIN API – Find out how your customers are paying

bins.ribbon.co

11–18 of 18 posts

Re: Ribbon BIN API – Find out how your customers are paying

#13
post #6
post #4

Very cool! But unfortunately the reality is most startups never capture the first 6 numbers of credit cards if they are using a payment gateway (stripe, recurly, etc). Do you have ideas on how we can access the BIN without compromising security if we're using said services?

Hi, I'm David, one of the engineers at Ribbon. If you use any payment gateway, you need to send the full credit card number from the client so the gateway can return a token that identifies the card in their vault. You can do the same and write some JS to get the first 6 numbers and send a GET request to our API without compromising security. The BIN (first 6 numbers of credit cards) is not considered the primary acc…

Can I store a BIN and associate it to a customer without breaking PCI compliance?

Re: Ribbon BIN API – Find out how your customers are paying

#14
post #6

Earlier quoted context omitted.

Hi, I'm David, one of the engineers at Ribbon. If you use any payment gateway, you need to send the full credit card number from the client so the gateway can return a token that identifies the card in their vault. You can do the same and write some JS to get the first 6 numbers and send a GET request to our API without compromising security. The BIN (first 6 numbers of credit cards) is not considered the primary acc…

Can I store a BIN and associate it to a customer without breaking PCI compliance?

You're allowed to store up to the first six and last four digits of a credit card number without encryption.

Re: Ribbon BIN API – Find out how your customers are paying

#16

Earlier quoted context omitted.

Can I store a BIN and associate it to a customer without breaking PCI compliance?

You're allowed to store up to the first six and last four digits of a credit card number without encryption.

https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd..., PCI DSS 3.3 would seem to be the most applicable section here.
Post reply on HN