Several questions

[rfm]

Hello,

First, my scenario:

1. 1) I have an order from page created using Silverlight where the following information is gathered:

         Quantity

         Product description

         Product cost

         Shipping cost

         Taxes

         Total cost

         Billing:

               Company

               First name

               Last name

               Address line 1

               Address line 2

               City

               State

               Postal code

               Country

               Phone

               Fax

               Email

         Shipping:

               Company

               First name

               Last name

               Address line 1

               Address line 2

               City

               State

               Postal code

               Country

         Credit cart type (American Express, Discover, Master Card, VISA)

         Credit card number

         Expiration date (Month Year)

         Security code

   2) After the order form is filled out the user clicks the Submit Order button.

What I would like to happen when the user clicks the Submit Order button depends on what Authorize.Net has available, is able to do, and cost:

1. 1) The preferred action is for all the above information to be sent to Authorize.Net and saved and a result returned (accepted or declined) so that I can display the appropriate next page.  This assumes that Authorize.Net can save the above data at a reasonable cost and that data can be downloaded to our  server for mailings (email).  This method would not involve our web server.
2. 
   2) The other action is that the above data is POSTed back to our server and we save the data in our database and send a request with the necessary credit card information for processing and receipt of a result (approve or declined) so the server make the appropriate response.

Assuming Authorize.Net can save all the above data at a reasonable cost:

1. 1) How long is that information saved?
2.  
3. 2) In what form is the saved information downloadable?

I read in the Developer FAQs the following:

If you, or your merchant, do not have an SSL certificate, we recommend Direct Post Method (DPM). Direct Post Method uses a unique fingerprint to authenticate transactions, so developers customize a secure hosted payment form without needing an SSL certificate.

It is my understanding that we would not gather such information outside a SSL link, is this correct?

Is that form your form on your site?

Regards,

Robert

[Trevor]

First off, I do not know if you will be able to use Silverlight with DPM.  DPM requires an html form to submit data directly from the customer's browser to Authorize.Net.  If this is not possible with Silverlight, then you will want to look into AIM.

As for storing the information, Authorize.Net will store all transaction details and most of that information will be available to you either programmatically through the Transaction Details or through the online merchant interface.  Of the fields that you listed, the only fields not retrievable would be the Credit Card Number, Expiration Date, and the Security Code.  The last 4 digits of the card number will be returned.  The rest of the information is stored and retrievable for at least 2 years after the transaction has processed as long as your Authorize.Net account remains open.

It is also worth noting that if you were to go with option 2, this would dramatically increase the difficulty of being PCI compliant.  It would also not be allowable for you to collect the customers Card Security Code, as this cannot be stored at any time.