When a customer buys from you, Ontraport can save their credit card. That's what lets you run subscriptions and payment plans, and charge a customer again whenever you need to. In this lesson, you'll see how saved cards work, what you can see, and how to keep your own handling of card data to a minimum.
Ontraport is PCI DSS Level 1. PCI DSS is the card industry's security standard, and any business that accepts credit cards is expected to follow it. I'm not a lawyer, so treat this as an overview, not legal advice.
Your customers enter their card on your order form. Where the full card number is kept depends on your payment gateway. The standard Stripe gateway stores cards in Ontraport and sends them to Stripe for each charge. Stripe Token keeps the card in your Stripe account and gives Ontraport a token to use instead of the raw card number. And Authorize.net CIM stores customer payment profiles with Authorize.net.
Open a contact's record and go to the Purchases tab. Under Credit cards on file, you'll see every card saved for that contact. Ontraport doesn't keep the full card number in the contact record. You'll only see the card type, the last four digits and the expiration date. From here, you can add a new card, set a default card and update expiration dates. Managing transactions this way is available on Plus and above, and saving more than one card per contact is available on Pro and above.
Changing the default card doesn't change existing subscriptions or payment plans. They keep using the card they started with.
Ontraport never stores the three- or four-digit security code. It's used only on the original order form. So any form that charges a saved card again later can't require the CVV.
Once a card is saved, you can charge it anytime. Open the contact's record and click Invoice in the action menu. Set up the product, then in the "I would like to" dropdown, choose Charge credit card. Pick the saved card in the Credit card number field, confirm your gateway, and click Submit. You'll learn more about manual transactions later in this course.
The best setup is one where customers type in their own card details. They can do it on an order form, or on the payment page they reach by clicking Pay on an invoice. And with a customer center, they can update their own card and choose a default.
As a general rule, the less card data you and your team ever see or handle, the less risk you carry. Use online order forms rather than taking card numbers over the phone. For a repeat customer who calls in an order, charge the card already on file. If you do take new cards by phone or in person, look into your PCI responsibilities first, and never write card numbers down on paper.
So: Ontraport saves your customers' cards, you see only the last four digits, the CVV is never stored, and you can charge a saved card whenever you need to. Next up: creating coupon codes.