January 21, 2011

Tixato and Credit Cards: Way More than You Ever Wanted to Know

In my experience, building a product from scratch starts when your imagination catches hold of one or two specific images. Something capturing the emotional experience that will be triggered when the final product actually does the job it was built to do.

For Tixato, one of the key images my mind turns over and over is that of, as it turns out, the checkout screen. I know, not very sexy, right? But…I actually think it is. Or at least, it could be. The little bit of rage I feel slogging through pages of ugly, confusing, barely-usable 90’s era web forms when I buy a ticket is one of my personal motivating factors to make this thing.

Which brings us to the topic of credit cards payments.

Because you can’t build a beautiful online order widget without processing credit cards.

Setting up credit card processing for Tixato has been a fascinating adventure. I’d like to share what I’ve learned, and what it means for how Tixato will work. I’m going to get into some geeky stuff here, but I figure if you’re reading this blog you’re interested in the nitty and the gritty.

First, some basics

There are a lot of moving parts when it comes to processing money. Here are a few basic things to keep in mind:

Merchant Accounts. This is the basic account you must establish if you want to process credit cards directly. These accounts are established with a bank that has a relationship with the credit card companies. These banks are able to process a credit card sale, and deposit the money into your bank account.

Payment gateway services. You know those card swipe machines you use at the coffee shop or the grocery store? This is basically the fancy internet version of those card swipe machines. They talk to the processing merchant account. When you set up online sales, the payment gateway lets your web application talk to the merchant account and Do Stuff With Credit Cards™.

PCI compliance. Thieves like money. To prevent thieves from getting money that isn’t theirs, the credit card companies have strict rules about dealing with credit card numbers. They’re very serious about these rules. They includes rules about who has access to the credit card numbers, how those numbers are stored, how records are preserved and destroyed, etc. This is all good stuff, but it’s also a huge pain in the butt to get right, and requires a lot of cost in terms of compliance and insurance if your company needs to take it on.

Next, some Tixato specifics

There are two ways we’d like Tixato to work.

First, if you work for a company that already has a merchant account, we want you to be able to use that account. You may have put a lot of work into getting a low rate, or you may have a good relationship with your account provider. We want you to be able to use your existing account with Tixato.

Second, if you don’t already have a merchant account, we want you to be able to use Tixato anyway. We want you to be able to set up your event, and start selling tickets within a few minutes.

Why this Starts to Get Tricky

Now, here’s where things start to get interesting. The second model I listed, where you can use Tixato without your own merchant account, is called a “payment aggregation” model. It means that we, as Tixato, are collecting money in our own account, and then sending you a check later.

Makes perfect sense, right? Except the credit card companies hate it. Absolutely hate it. And not without reason.

The problem, from the perspective of the credit card companies, is that a payment aggregator is selling something it doesn’t own. In the case of Tixato, we’re selling tickets to other people’s shows. This means we have no direct control over the quality of the thing we’re selling, i.e. the show. If a show is canceled, who refunds the money? The credit card company doesn’t have a legal relationship with the venue, they have a legal relationship with Tixato. What if we sent out the money and can’t get it back? Or what if we were unethical and spent it, because we temporarily had a bunch of it in the bank, even though it’s really yours? At the end of the day, the customers have a right to a refund, and the credit card company is scared they’ll be on the end of that hook.

And yet, this is exactly the model we most want to offer. We’re making Tixato with the little guys in mind. What to do?

When the Going Gets Tough, the Tough Negotiate

I’m happy to report that, after a fair amount of work, we’ve reached an agreement with the credit card companies. We’ve described a cash flow that reduces risk, and still lets us provide this aggregate model.

There are two keys to how this will work:

Tixato won’t charge the customer’s credit cards until a day or two after the show has actually taken place. When a patron orders a ticket, we can check for sufficient funds, but we won’t actually charge the card. Then, when we know the show has taken place, we can charge the cards for the patrons.

This part of the model has some nice properties. For one thing, it means refunds up until the day of the show don’t cost any credit card processing fees, because you haven’t actually run the card yet.

The next step in the cash flow is to get the money out of Tixato and into your hands as soon as possible. The idea is that the credit card companies don’t want us holding on to the money, and theoretically tempted to use it for ourselves. Not that we would, but you know, you have to plan for the worst when you’re a credit card company. And anyway, it’s your money, you should have it as soon as possible. Initially, that will at least mean that we’re sending out checks at least once a month. But what I’d really like to see is electronic direct deposits into your accounts, so we can send the money automatically and right away. We’re still exploring our options there, but that’s the goal.

Enter Braintree

Well, this financial model is all hunky-dorey, but we actually have to be able to, you know, DO it.

Luckily, there is an awesome company called Braintree. They’re a first-rate payment gateway company with some amazing technology and some incredibly good support. For one thing, the fine folks at Briantree worked with me to negotiate the above terms for our merchant account. For another, their technology lets us do everything we want to do in Tixato.

Braintree’s API lets us create integrated credit card processing widgets without ever actually seeing anyone’s credit card. (Remember PCI compliance? Briantree takes care of that.) They let us easily integrate all kinds of processing magic, storing credit card numbers in their vault, performing checks for sufficient funds, issuing refunds, etc, without ever sending anyone to some other website. We can build a payment page directly in Tixato, or even better, we can work on building widgets for you to put in your pages.

Yay! The World is Perfect!

Almost. There’s one last wrinkle.

The technology that payment gateway services use is tied closely to the technology the merchant account services use. And here’s the wrinkle: the United States uses one kind of technology. The rest of the world uses another.

Oof

You said it.

Does that mean Tixato can’t provide credit card processing for international customers?

Well, it’s complicated. Consider the following:

There are companies like PayPal which do provide a service to process purchases in many countries. But if you use the simple version of PayPal, you’re sending patrons to an ugly page offsite, we can’t provide any automated transaction help (such as performing refunds within Tixato), and the whole experience is just not up to the level we want to provide. If you use something like PayPal Payments Pro, you can do more integration, and provide checkout pages without going off-site, but, and this is a biggy, you are now responsible for PCI compliance. This is a big can of worms, and less safe for our customers. (And, of course, any version of PayPal is…dealing with PayPal. Speaking from experience, their customer support is just terrible. Not a good place to be.)

So if we want to use a great company like Braintree, that provides all the integration options we want, and amazing customer service… no, we can’t provide credit card processing for international customers.

….exceeeept, there’s still one last wrinkle.

Success Breeds New Options.

If Tixato starts processing a lot of ticket sales, suddenly everything changes. How many ticket sales? The magic number is 3 million dollars. If we reach that milestone, we’ll suddenly have access to payment processing services that can handle the entire world. We’d still be using Braintree, but we’d be connecting to new payment processors on the back end. Getting access to these high-end processors means we’d have all the technological features we need, and be able to provide them to just about anyone in the world.

So. At the moment, that’s the plan: kick as much ass as quickly as possible, and hit that magic 3 million dollar mark.

We’ve had a lot of positive response from beta testers in other parts of the world. During the beta we’ve added support for other languages and other currencies. And we’re bummed that it looks like we won’t initially be able to provide credit card processing for those folks.

But I think we can get there, and I’m excited to try.

And in the meantime, to all my friends in the United States, well, you get the luck of the draw. You’ll get everything Tixato has to offer. You lucky devils you.

Posted by Chris