API for secure data storage?

3 points by snaveint 11y ago ↗ HN

Have a payments problem we're trying to solve, would love HN input!

Our platform needs to make several payments to suppliers each week, the problem is we don't want to store our suppliers bank details. Unfortunately the only payment method possible right now is via a bank specific file (*.aba) and is manual, but to create that file we need to have stored our customers bank details...

Does anyone know of a platform which can store/retrieve customer sensitive data through an API so we can avoid storing it ourselves?

5 comments

[ 2.9 ms ] story [ 24.7 ms ] thread

tptacek 11y ago ↗

What you're looking for is called an HSM.

stevekemp 11y ago ↗

Yes and if you wanted to write an API for such a thing it is pretty simple. The key is that you never allow retrieval of the data.

So your API has to support essentially two methods:

* Add banking details. * Make a charge.

You submit the details to get back a token such as "account-1", and use that token to make a charge. The actual banking details are never able to be retrieved from the device.

snaveint 11y ago ↗

Thanks guys, sounds promising, will look into it.

rgacote 11y ago ↗

Tokenization service like http://www.auricsystems.com/products/auricvault-tokenization...

snaveint 11y ago ↗

Thanks, have dropped them an email to see if they can support what we're after. Appreciate it.