Spreedly Core, PCI-DSS, Gateway Autonomy and commerce. A Guest Post on our blog

I know the spreedly guys, as well as outside devs who independently adopted spreedly. Everyone I know has said what a pleasure it has been to use the Spreedly API.

If you want a feature list, you can always go hit their site: http://spreedly.com/info/features

The data is absolutely transferrable today - we've had multiple customers leverage that transferability to switch (or augment) their gateway with just a configuration change.

Of course, it's not just about data portability; API consistency is a big deal as well. If PayPal (for instance) decides to lock down your account and not let you transact any longer, you don't just have to worry about getting your data out, you are also looking at another whole implementation cycle around a new API. Even if it's just a day of work (and usually it takes longer), that's a day you could've spent on your product instead of mucking around with gateway API's.

There are of course libraries that help make gateway API's more consistent, but as a committer on what is in my opinion one of the best - ActiveMerchant - they only get you so far. For instance, Core gives you transparent redirect on top of any gateway we support. That means lowered PCI compliance requirements and a great experience for your customers, and there isn't a library out there that can do that for you.

Spreedly Core isn't for handling specific requirements per se, but changing the entire scope of compliance. Basically, if you're only only doing card-not-present transactions and you never store, process or transmit cardholder data, you qualify for SAQ A. The full eligibility requirements for SAQ A consists of the following:

  * Your company handles only card-not-present (e-commerce or mail/telephone-order) transactions;
  * Your company does not store, process, or transmit any cardholder data on your systems or premises, but relies entirely on third party service provider(s) to handle all these functions;
  * Your company has confirmed that the third party(s) handling storage, processing, and/or transmission of cardholder data is PCI DSS compliant;
  * Your company retains only paper reports or receipts with cardholder data, and these documents are not received electronically; and
  * Your company does not store any cardholder data in electronic format.

Agreed, visual examples of integrations would spice up article

Agreed, except... we actually don't have a UI to show. The transparent redirect approach that Core takes means that we'd just be showing you our customers' payment pages, which while spiffy, don't really tell you anything about the integration. Which is kind of the point - our goal is to be invisible.

Doh!. Fixed thanks.