You are here:
PCI Compliance in Salesforce Billing
The Payment Card Industry Data Security Standard, also known as PCI Compliance, is an information security standard for companies that accept, process, store, or transmit credit card information from major credit card providers. Salesforce Billing became PCI Level 1 compliant in 2012 and has retained its compliance every year afterward. (Salesforce Billing Managed Package)
Required Editions
| Available in: All Salesforce Billing Editions |
Salesforce Billing stays PCI compliant by never storing any credit card information before, during, or after payment method collection. Payment card information is transmitted only to payment processors through a token and never stored along the way within Salesforce. The payment method record contains the payment processor token, which links to the actual Personal Account Number stored on the payment processor. The processor token is unique to the customer, payment card, merchant, and payment processor.
Tokens allow systems like Salesforce to store a representation of the customer’s payment card, and change it, without having to store their actual payment card information. In the event of a data breach, tokens aren’t useful for the thief as the token works only when used with the original merchant and payment processor.
Salesforce Billing stores the following credit card information on each payment method. This information is stored either during the payment collection process or by creating a payment method related to an account. Each payment method contains the following credit card information.
- Name on card
- Last four digits of credit card number
- Card Type
- Token
- Expiration month and year
The payment center automatically creates a token during the process of successfully processing a payment. Salesforce Billing performs the following steps when using tokens during payment processing.
- A user initiates payments through the Payment Center.
- Salesforce passes the token to the payment gateway as an authorized request.
- The payment gateway receives the token and routes to the credit card provided to begin processing.
- The credit card provider accepts or declines the transaction.
- The token and payment authorization are routed back to the payment gateway.
- The payment gateway provides Salesforce a successful or unsuccessful response.
All Salesforce API communication is encrypted and highly secure. The encryption logic isn’t part of the Salesforce Billing triggers. So, even if you save payment methods when the triggers are disabled, the saved records are PCI-compliant.
If you create a payment method and provide a CVV value and full credit card number, Salesforce Billing doesn't store the CVV and stores only the last four digits of the credit card number to ensure PCI compliance. If you edit a payment method where the CVV is already populated (for example, from a data migration while Salesforce Billing triggers were disabled), the save will fail and show a "can’t change credit card information" error message. To save the edited payment method, delete the contents of the CVV field.
Staying PCI Compliant with Salesforce Billing
If you’re building a custom Salesforce component that collects user payment information, take special care to not store credit card information within Salesforce or any system that’s not designed to store credit card information.
If you’re migrating customers into Salesforce Billing, ensure you’re also migrating payment card information in a PCI-Compliant manner. Each of your customers will likely have to work with their existing payment processors to regenerate tokens that will be valid with Salesforce.
