Comment by qeorge | Hacker News Reader

Comment by qeorge | Hacker News Reader

Parent Full thread

I'm missing something. Can you explain this to me as if I were five? I'm really gun shy with anything involving my customers CC data, and I suspect others are too.

Some of my concerns:

1) Authorize now but only charge when actually shipping is standard Visa policy. Doing it any other way is not allowed. Your system seems like a workaround for that, which raises my alarm bells.

2) To be clear - you are storing the credit cards in your vault (not Stripe's vault), and then running them through your Stripe account later as normal transactions? And this is cool with Stripe/Visa?

3) What do you mean PCI compliant? Do you think you are, or are you being regularly audited? Where are your servers? Credit cards are serious business; we need to know.

4) I'd expect a ton of chargebacks. How are those handled? What do the chargeback fees look like?

5) Is this Amazon Payments without the branding?

I want to love your product, but I wonder these things. Please help me understand!

In the case of pre-ordering, Celery doesn't make any authorizations/holds upon the creation of the order. We use Stripe to make sure the card is valid and the charge is processed at a later time.

Celery does not store the credit cards and all payment information transferred is encrypted with SSL. The cards are held within Stripe's vault. Each seller uses their own Stripe token.

The chargebacks would affect the seller, since the payments are linked to their Stripe account. It's important that seller is able to actually ship the item if they decide to charge the buyer. Otherwise, they would need to refund or risk getting hit with chargebacks.

Whoa - you need to make it clear that I have to bring my own Stripe account. Nowhere is that mentioned on your page. So the 256-bit encryption you're touting on your homepage is really Stripe's 256-bit encryption? Not cool.

Is the "Embeddable Checkout Overlay" really Stripe Checkout too? Which of your features are you actually providing and which are really Stripe?

Right now this looks like a simple wrapper around Stripe Connect that waits X days to bill, plus a basic Bootstrap template you can use. What am I missing?

Thanks for the questions. We're working to update the FAQ and site to make all of this more clear. My personal belief is that there's more to commerce than just payments (order management, inventory management, analytics, supporting web and native mobile/tablet apps, etc). It may look simple now, but these are the types of challenges we're in the process of tackling.

I'm confused, have you looked @ balancedpayments.com? We offer this out of the box without you having to go through this and we're YC W2011.

> 1) Authorize now but only charge when actually shipping is standard Visa policy. Doing it any other way is not allowed. Your system seems like a workaround for that, which raises my alarm bells.

According to their demo product page[0], your card is only charged when the product ships. Is that your concern?

[0]: https://www.trycelery.com/p/my-first-product

I second qeorge's concerns about PCI compliance and credit card storage.

Futhermore, credit card processors and banks do not want to be on the hook for what happens when the items do not ship in these pre-order scenarios. The CCs are all about limiting their exposure to risk and this opens them up to a number of issues regarding products not shipped on time, not as advertised, etc.

Reply on news.ycombinator.com