What are the alternatives? (Don't say PayPal -- they seem to have a habit of locking out these types of accounts too.)
We'd love to hear of alternative payment systems. I'm looking at using subscriptions in https://www.braintreepayments.com/docs/python/subscriptions/ to simulate conditional payments. http://www.quora.com/Online-and-Mobile-Payments/What-payment... leads to https://www.wepay.com/ and https://www.balancedpayments.com/ I'd love to hear of people's experiences with these payment systems and any others we should look at for unglue.it
Then, you have the issue as to whether or not the card has the amount available in the future when you intend to charge it...
If you use SpreedlyCore, for example, you point your signup/billing form to their server, which stores the card data then redirects back to your site, so the user never sees anything but your site yet the payment data never hits your server. If you use Stripe, for example, the form submission gets intercepted by JavaScript that sends it to Stripe instead of your server, then returns a token in a callback. If you use services like these, there's virtually no compliance burden at all.
> Then, you have the issue as to whether or not the card has the amount available in the future when you intend to charge it...
You'd have that issue whether you used a 3rd party processor or your own merchant account. Amazon Payments wouldn't have given them money when the customers' cards had no funds either.
BTW: There is no PCI-DSS or PA-DSS level that allows storing of verification codes, for either businesses or payment software companies. The whole point of that code is that it's never stored.
"No, you simply send the card details to the payment gateway which vaults them. You get back a token to reference to make the actual charges in the future. You don't have to do an authorization up front. Virtually every payment gateway has such a feature. There's no need to implement storage on your own and take on the compliance burdens."
Neither Authorize.net nor MES do. (Two of the largest in the US, that I've been using for the past few years.) I only know of a few specialized players that offer such functionality.
http://www.authorize.net/solutions/merchantsolutions/merchan...
http://merchante-solutions.com/files/MES_PaymentGateway.pdf
I'm surprised you've been using these gateways for years and didn't know about these features. CIM is prominently advertised on the first page you see every time you log in to the gateway.
I haven't had either of those features enabled in my UI, but that wouldn't surprise me as I've often had to ask them to re-enable basic features (like backoffice w/ MES) when they get accidentally turned off. I'm presuming these features need to be negotiated as part of the deal, and as I haven't needed them, they were never brought up.
With Braintree you could put customer CC numbers in their vault and then manually run the transaction later, but it'd cost you a flat fee plus a penny or two per/card/month. (They do support running validations without completing a transaction.) It doesn't seem like the end of the world, though. And the architecture isn't super complicated. I assume you already had to handle telling Amazon whether to go through with the charge or not after the time period? Maybe Amazon also was keeping track of the pledge amounts for you?
(Contrib Id or Card Id, Pledge Amount, Campaign Id) doesn't seem like that crazy of a thing to store on your own system.
If there are other processors that support pledges, we aren't aware of them (though we welcome suggestions!).
We're working on an alternative funding model that lets us deal with this, but that's a question of business logic as well as software. Mind you, we have a fair amount of both in place already, but there are a lot of moving pieces. We'll keep people posted via our blog, newsletter, Twitter, & Facebook page.
What you can do quite easily with WePay is to send bills by email, each including a link to the payment page with the amount filled in. This makes it pretty simple for people to pay at that point. But it isn't, admittedly, automatic, and some people could ignore the bill. I don't know how big a problem this would be in practice.