I've recently got not bad at skinning & customising OpenCart, just starting off small, not moved on to Magento or anything like that yet. Anyway, this opens up possibilities of me offering lightweight shopping cart solutions. OpenCart seems ok from what I can tell for a very small shop.

 

Question is - as a Sole Trader and not a Limited Company, how far to go with this - for example only sticking to using Paypal payments rather than direct Card payments with SSL. I worry about this slightly as a Sole Trader - is this not opening yourself up to some pretty heavy legal implications should the site for example get hacked, or some other discrepancy arise to do with the SSL or Card details etc.

 

Do you Sole Traders steer away from doing this for those reasons? Is it best to limit yourself to only integrating Paypal? Or do you just put a clause in your contract protecting yourself?

The normal method is to use a 3rd party payment gateway such as sagepay, SecureTrading, Worldpay etc - all these transact card info offsite so you lessen the risk of targetted hacking.

 

If the client chooses to do their own card processing you need ensure the appropriate PCI guidelines are met - these cover site and software, server and server security plus a whole host of other things, all of which are the clients responsibility but they may come to you to help answer some of the technical questions.

Even using a third party to take care of the payments (such as the banks gateway) so its all done off site you still have to comply to PCI legislation

I have done lots of e-commerce sites for companies and currently using Prestashop along with SagePay , Royal Bank of Scotland, Google Checkout etc.

 

For the API to work SSL is a requirement , I know you can use it without but usually you get lots of errors. As for credit card information nothing is or should ever be stored in the database tables besides transaction codes , maybe the last 4 digits.

 

You might want to take a look at professional indemnity insurance who provide insurance for instances such as this. Its quite reasonable and insures you against legal action of up to 100k I think.

Edited June 29, 201115 yr by Sinero Web Design

You don't need the SSL if your taking payments off site, which with all the legal crap around at the moment is best and cheapest course of action for starting out