Paypal Vault and PCI

1
votes

I was looking into the Paypal Vault capability and found the following suggested sample code:

https://github.com/paypal/PayPal-Java-SDK/blob/master/rest-api-sample/src/main/java/com/paypal/api/payments/servlet/CreateCreditCardServlet.java

And this example contains this:

    CreditCard creditCard = new CreditCard();
    creditCard.setExpireMonth(11);
    creditCard.setExpireYear(2018);
    creditCard.setNumber("4417119669820331");
    creditCard.setType("visa");

The servlet creates a credit card object and submits it to Paypal Vault. The example seems simple. However, the fact that my server has to process credit card and send them to Paypal worries me. Doesn't this suggest PCI compliance and so defeats the purpose of the Vault?

2
paypalpaypal-sandbox

2 Answers

2
votes

If you use the REST APIs for direct card processing, you need to validate your own site against PCI-DSS. Since VAULT deals with direct card payments, you will need to be PCI compliant if you are using VAULT.

https://developer.paypal.com/docs/faq/

0
votes

I think the Vault API should be changed 'cause it seems there is the possibility to store also the CVV2 even if that field cannot be stored anywhere due to PCI Compliance (and the fact that you do not store that value is confirmed in a Github issue).
Changing the API will be great, I think.
Cheers