Trying to setup a secure system. Need a lot of input.

[Paradigm]

A client of mine has requested to have gift certificates available on her website so her clients can purchase them online through some kind of secure system.

I'm not familiar with what kind of online secure system services are available for things like this. Yahoo? PayPal?

I would like it to be an automated secure system so people can use their credit cards to purchase it, then sent an email containing a random Gift code and the picture showing the gift certificate (printable).

Any advice? Your help is greatly appreciated. Thank you.

[Corey Bryant]

What shopping cart is she using already? Does it have the ability to have gift certs etc?

You need an electronic payment gateway, merchant account, an SSL cert. Basically the same things that you need for selling items online

[willthegeek]

Some ISPs offer a shared SSL certificate that you can use on your site. They will also have a secure area for placing the pages you want to keep secure. Have your client check with them.

The credit card payment processor will also supply a secure location. It sounds a lot more confusing than it is.

Regards,

Will

[Shift4SMS]

The system your describing "sounds" easy but it is much more complex than you might think. The problem is financial risk -- while a successful gift card or gift certificate program can be VERY profitable, they are liabilities on your books because you are basically taking loans from your customers.

First of all, you need a secure server and by secure, I'm not just referring to an SSL certificate. Your server should be a dedicated server as shared servers are very hard to secure with confidence. You'll need a database hosted on another server again because of security. You'll need some sort of payment gateway to funnel the payments for these gift card or certificate purchases. All these are readily available or solvable; my point is that it is a larger project than simply creating a payment page and emailing out certificates.

A note about my experience: Shift4, the company that I work for, markets a product that was written to support both gift cards and e-certificates like you describe. We have thousands of gift cards being tracked and processed through the system. As of yet, we do not have anyone using the e-certificate capabilities. The biggest problem is that email is not secure and this adds several risks in and of itself: 1) anyone can intercept the certificate, 2) multiple copies of the certificate can be printed, 3) the certificate can be sent to the wrong address, etc. All these situations need to be considered when weighing the risks. While physical gift cards do not solve all the issues, but they significantly reduce some of the risks because they are harder to forge and they are physically shipped to an address.

Sorry for the bad news.. ;-(

[Shift4SMS]

The system your describing "sounds" easy but it is much more complex than you might think. The problem is financial risk -- while a successful gift card or gift certificate program can be VERY profitable, they are liabilities on your books because you are basically taking loans from your customers.

First of all, you need a secure server and by secure, I'm not just referring to an SSL certificate. Your server should be a dedicated server as shared servers are very hard to secure with confidence. You'll need a database hosted on another server again because of security. You'll need some sort of payment gateway to funnel the payments for these gift card or certificate purchases. All these are readily available or solvable; my point is that it is a larger project than simply creating a payment page and emailing out certificates.

A note about my experience: Shift4, the company that I work for, markets a product that was written to support both gift cards and e-certificates like you describe. We have thousands of gift cards being tracked and processed through the system. As of yet, we do not have anyone using the e-certificate capabilities. The biggest problem is that email is not secure and this adds several risks in and of itself: 1) anyone can intercept the certificate, 2) multiple copies of the certificate can be printed, 3) the certificate can be sent to the wrong address, etc. All these situations need to be considered when weighing the risks. While physical gift cards do not solve all the issues, but they significantly reduce some of the risks because they are harder to forge and they are physically shipped to an address.

Sorry for the bad news.. ;-(