megetron:so what you suggest is to encrypt the credit numbers before store them on DB
No, encryption relies on a key, which if compromised, would give someone access to all of the credit card numbers you stored. The strongest thing for encryption of this type is a cryptographic key management server, which we don't have - they cost LOTS of $$ - but they cycle keys based on policies you set up. (BTW - if anyone wants to build one - I'd be interested.
)
What I would suggest is not keeping the data at all. As Yitzchok has mentioned, most of this risk / exposure can be pushed down to the payment provider. Not sure what your reasons are for not using a payment provider, but this is about the best reason TO use one.
As for all your other questions, you can check out the PayPal payment providers - they are good examples on how to get a payment priovider. Also, Robert_Mims has a brief TODO list of sorts on how to create the providers, which you can do a search for.
Hope this helps.
--
Support dashCommerce -
Buy Our Stuff!!Find a bug? Create a
Work Item for a fast response.. Want to help?
Create a patch for us! Documentation? Help us
write some!