paypaldrupal-7authorize.netcivicrm

Can CiviCRM store credit card information for donation campaign?


I am using CiviCRM with Drupal 7.x. My question is: Can CiviCRM store credit card info? Because I want to check detail for security prospect view.

And also: if it's saved, how is it managed in CiviCRM admin?

Currently I'm setting up Paypal or Authorize.NET for normal and recurring contributions in Payment Processor settings.


Solution

  • Tools like CiviCRM should avoid storing credit card details like the PAN, since they may rely on tokenization with the payment gateway to charge future payments against a card if permission is granted at checkout.

    For PCI compliance, software like CiviCRM is permitted to store only partial card details + a reference to the gateway's token (search "credit card tokenization" for more on this). PCI/DSS does permit storage of full PANs if you take "certain steps", but you really don't want to do that - a significant undertaking which exposes your org to significant risks.

    How CiviCRM implements recurring billing will depend on the payment processor you select. For Authorize.NET in CiviCRM you use their ARB service, and a similar setup for Paypal; in essence you instruct the gateway to set up a scheduled payment on the card. After that it remains in effect until cancelled (presumably by you, the cardholder, or card expiry).

    Full details on the payment processors you refer to are at -

    Other payment processors are available including some from the extensions directory which permit recurring billing - you will need to evaluate options for your organization.

    Since tokens are stored at the payment processor, you might find it hard to shift payment processors down the track as you risk losing any payments that people don't transfer. Choose wisely and for the long run :)