Skip to navigation
CollectBest Practices

Security Best Practices

Ensure secure integration and data handling with CrissCross

Overview

Security is a critical aspect of any payment processing solution. CrissCross enforces strict security protocols to ensure that merchant and customer data is protected throughout the transaction lifecycle. This document provides security best practices to follow when integrating CrissCross into your system.

Access Token Management

  • Manage OAuth Credentials:

    • Store your client_secret securely and rotate it if you suspect compromise.
    • Use the Authentication guide to obtain short-lived access tokens.

  • Separate Environments:

    • Use different credentials for sandbox vs production to prevent cross-environment mistakes.

  • Keep Credentials Confidential:

    • Never hardcode client_secret in source code.
    • Use environment variables or a secrets manager.

PCI Compliance

  • Understand PCI-DSS Requirements:

    • CrissCross never accepts raw card data on the API — card collection happens on Hosted Checkout, which keeps raw card data out of your systems and can reduce your applicable PCI-DSS scope (typically towards SAQ A). You retain PCI-DSS responsibilities as a merchant — confirm your exact obligations with your acquirer or QSA.

  • Limit Sensitive Data Exposure:

    • Never collect or store raw card data in your own systems; hand the customer to Hosted Checkout for card payments.

Data Encryption

  • Encryption in Transit and at Rest:

    • Ensure all communication with CrissCross uses HTTPS to protect data in transit.
    • CrissCross encrypts sensitive data at rest to prevent unauthorized access.

  • Secure Storage Practices:

    • Do not store sensitive payment information locally unless absolutely necessary.
    • Use the tokens provided by CrissCross for subsequent transactions instead of storing card details.

Authentication and Access Control

  • Enforce Multi-Factor Authentication (MFA):

    • Use MFA for your CrissCross dashboard accounts to add an additional layer of security.

  • Role-Based Access Control (RBAC):

    • Limit access to sensitive data and features based on user roles.
    • Review and update access permissions periodically to avoid unnecessary access.

Use HTTPS and OAuth Tokens

Ensure all API calls are made over HTTPS and authenticated with OAuth access tokens. See the Authentication guide for the correct token flow and headers.

Monitoring and Alerts

  • Monitor for Suspicious Activity:

    • Use the CrissCross dashboard to track unusual API activity or payment patterns.
    • Set up notifications for failed login attempts or rate limit breaches.

  • Webhook Security:

    • Protect webhook endpoints with HTTPS.
    • Follow the Webhooks guide for verification and validation steps.

Handling Security Incidents

  • Incident Response Plan:

    • Prepare a plan for handling security incidents, including compromised keys or unauthorized access.
    • Revoke compromised API keys immediately via the dashboard.

  • Notify CrissCross Support:

    • In case of a security breach affecting CrissCross integration, contact support immediately for assistance.

Conclusion

Maintaining security in your CrissCross integration requires a proactive approach. By following these best practices for API key management, encryption, PCI compliance, and monitoring, merchants can minimize risks and ensure the safety of customer data.