TOPIC: Credit Card PCI Compliance Letter

You have to have the questions all answered or the scan will fail. There's also a few items which will fail as our security prevents them from getting a proper scan. Let me know what the items are and I'll give you the info to appeal the items.

Not sure what a loader is, what's the entire question?

OK, I am trying to do this PCI bullcrap. I sat through the webinar and those guys were no help, they even ended the webinar without answering my questions. I have to choose one of these options. Anybody got a clue? I have the system Dominic has set up. I am thinking I am the Fully Outsourced Model, but I am not sure.

Fully Outsourced Model
Choose this option if your entire e-commerce site is managed by a third-party. You may design the store and provide the product listings and prices, but the shopping cart is run by a third-party, including all of the order forms and payment collection and processing, and your employees have no access to cardholder data.

Payment Redirect Model
Choose this option if you manage your own e-commerce site except for the payment/order pages. Your site may be physically hosted at a colocation or hosting facility, but you are responsible for the web site and shopping cart. When a customer is ready to checkout and pay, they are redirected to a third-party (e.g. a payment gateway or payment service provider) to enter their card number before being returned to your web site for further information about your products or company. Customer credit card information is never sent directly to your web site.

Integrated Payment Model
Choose this option if you manage your e-commerce site including the collection of payment information. Your site may be physically hosted at a colocation or hosting facility, but you are responsible for the web site, shopping cart, and the payment/order pages. Customers enter their credit card information on your site, which then communicates with a third-party (e.g. a payment gateway or payment service provider) for authorization. Examples of this include the Paypal Payflow Pro and Authorize.Net services.

Other
Choose this option if you do not fit in one of the other three.

Payment Redirect Model. They are actually redirected to a Home Inspector Pro page to enter their CC info (it's just embedded within your site) which passes the information along to payfuse.

Thanks Dom, is The hosting from you compliant with the Payment Card Industry Data Security Standard? I am sure it is, but I want to confirm.

The PCI is bunk as far as I am concerned. I do not know what SAQ I am supposed to be and it has been 12 hours since I emailed Trustwave for an answer. I have no idea about all the technical questions. For example, it says my firewall is supposed to block all traffic then I have to add exceptions. If I do that I will have to go through and add sites I visit to the exception list. That is a ton of work.

Your firewall blocks incoming traffic so say yes. And yes we're complaint. This is how the CC industry is preventing congress from enforcing more rules on them. It's costing us $5,000 a year and we make nothing on it. Now that's bunk!

This is why I am just using PayPal.  I don't get a lot credit card users anyways.