Search code examples
e-commercepayment-gatewaymulti-tenantsaasbraintree

Storing Braintree API keys in SAAS application database

We're building a multi-tenant SAAS web-application. Our tenants want the option to accept credit card payments for the various products that we allow them to market through our application. To support this we will require that the tenant has their own Braintree account. The tenant provides us with their Braintree API keys through our app. We then use those API keys to interact with their Braintree account on their behalf (card storage, card verification and basic transactions).

This model is the same as the model used by the existing Braintree customers WooThemes, Goodsie, TutorTrove and many more.

We need to record the tenant's API info (merchant ID, public API key and private API key) for this all to work.

My questions are:

  1. Can we simply store this information in our application database?
  2. Does storing this information affect the PCI/DSS scope of us or our tenants?
  3. If we can't store the information in raw form, what is an appropriate storage form?

Note: we have contacted Braintree directly with this same question, but we didn't think it would hurt to get other opinions as well :).

Cheers, Sam

Solution

  • So Braintree responded to this question with:

    So long as your system is PCI compliant, and your merchants are aware that their API keys are stored on your server, then you should be fine. How you store the integration API keys is completely up to you, and [we] don’t really have any best practices to offer.

    So, it doesn't seem like this case affects the PCI/DSS scope of our product, and it seems we are free to choose an appropriate way to store the private API keys that we obtain (saravanan's suggestion is one possible option).