Pin is Australia’s first all-in-one payment API

Consider that we are supposed to trust you with our customer's credit card information, their and our money. Currently I'm thinking: Who are you and why should I trust you? There is no information on your site which would give me any confidence. I'm sure you have all the info, but please share it with us.

Using an HTTPS connection is all well and good, but it is not enough. HTTPS is susceptible to man in the middle attacks [1], and securing the params with a pre-shared secret key is essential.

The extra cost in 'complexity' is really far outweighed by the (warranted) extra security.

[1] http://www.thoughtcrime.org/software/sslstrip/

Either I put my secret key in the javascript and initiate the request in the browser (thus leaking my secret key), or I accept the inputs onto my server and forward the request to Pin, thus increasing PCI compliance burden because now sensitive data is passing through my server.

I'd like this more if it functioned closer to Braintree's transparent redirect. https://www.braintreepayments.com/developers/api-overview No sensitive data ever touches my servers (customer's POST goes to Braintree, and then they redirect to my server with a query string token that I use to validate the tx with Braintree).

Broadly speaking, because the credit card industry is a massive, bloated, inefficient mess, and the effort and liability required for a small business to participate in that mess directly can literally be business-destroying. And that's assuming the Powers That Be graciously allow you to play their little game at all, which may take several weeks of approval process to decide, and will almost certainly come with silly levels of fees on each transaction and terms so one-sided they could right a sinking ship even if you do jump through all of their hoops.

Having an intermediary that can provide a simple API that just works instead of having to integrate with some absurdly complicated and poorly documented API offered directly by the big players can save weeks of hassle. Similarly, having an intermediary that can take care of compliance with the dreaded PCI DSS (the industry security standards) is also a huge win. Finally, because the intermediaries tend to be bigger fish in the pond, you will often get a significantly better deal out of them in terms of how quickly you get your money, and how much of your money you actually get to keep.

All of this is particularly true for start-ups with no trading history, which of course will include just about any new on-line business. Once you've got a proven track record you can give solid answers to the financial questions and actually make the big boys compete for your business as they should, at least to some extent, but if you're starting from zero then the first thing a lot of these companies see is a huge potential fraud risk, particularly if you're in any kind of "dubious" industry or, again like many on-line SaaS businesses, you want to use a continuous payment authority to take recurring payments from a customer's card and not just a one-off transaction.

Unfortunately, there has to be some sort of big player on the other side of any intermediary (or, possibly, several big players used for different kinds of transaction) and so it's not unusual for these intermediaries either to be limited in geographic scope or to provide a partial service but still require you to sort out your own connections with a payment gateway and/or merchant account based in your region (though the intermediaries will probably be able to help with that process, which is still better than nothing). Thus while the US appears to have an effective and fast-growing young industry in payment processing services, those of us in other regions can only look on with jealousy and bow down before the mighty PayPal/Google/other vast multinational with a self-contained payment service.

As someone who has credit cards from 3 different countries, I can tell you that's very wrong. I'd like to think my CC works anywhere, but oftentimes when they ask for a ZIP and I don't have one, that's a deal breaker. Sometimes when the person sees the card is from another country (name of country is in the bank name) they refuse to use it, even when it matches my accent and driver's license.

Also it would have been nice if VISA had a global "credit rating" instead of a separate one for each country. Unfortunately, I now have zero credit in my new country, which is painful when I have amazing credit in my previous country. (all VISA cards)

Hosted PayPal is country-agnostic, but it looks amateur hour.

Paypal/Amazon/GCheckout work globally because they use CC and charge handsomely for the privilege. Companies like Pin, Stripe and Dwolla are trying to cut out the idea of merchant accounts (which create the major hassle for a lot of small practitioners), but that means tailoring your service for local laws = hard problem.

Yep.

Disclosure: I work at Braintree. I'm not trying to shill here - I'm genuinely curious about how people think about our stuff vs. other payments companies.

    if( !Australia )
        document.body.setAttribute("style","-webkit-transform: rotate(180deg);")