Customer and credit card breaking changes

This article covers breaking changes related to credit card data storage, PCI DSS compliance requirements, and customer-related APIs in Commerce Connect 15.

ICreditCardPayment interface removal

The ICreditCardPayment interface and all its implementations have been removed due to PCI DSS compliance requirements. Storing raw credit card data is a significant security and compliance risk.

The following types have been removed:

• EPiServer.Commerce.Order.ICreditCardPayment
• Mediachase.Commerce.Orders.CreditCardPayment
• EPiServer.Commerce.Order.Internal.SerializableCreditCardPayment
• OrderContext.CreditCardPaymentMetaClass property

CreditCard class removal

The Mediachase.Commerce.Customers.CreditCard class and all related types have been removed:

• Mediachase.Commerce.Customers.CreditCard class (including all methods: CreateInstance, Delete, CreditCardTypeFriendlyName)
• Mediachase.Commerce.Customers.CreditCardEntity class
• CreditCard.eCreditCardType enum

CustomerContact credit card methods removal

The following credit card management methods and properties have been removed from CustomerContact:

• CustomerContact.ContactCreditCards property
• CustomerContact.UpdateCreditCard method
• CustomerContact.AddCreditCard method
• CustomerContact.DeleteCreditCard method

Organization credit card removal

• Organization.CreditCards property has been removed.

CustomerContext credit card methods removal

The following methods have been removed from CustomerContext:

• CustomerContext.GetContactCreditCards method
• CustomerContext.GetOrganizationCreditCards method

CustomerEntityFactory credit card support removal

CustomerEntityFactory support for CreditCard creation has been removed.

Database objects removal

All database objects related to credit card storage have been removed, including tables, stored procedures, and related schema objects.

Migration path

Consumers must migrate to PCI-compliant tokenized payment solutions using third-party payment providers (for example, Stripe, Adyen, PayPal).

Instead of storing credit card data directly, store only payment tokens and provider transaction IDs using the IPayment interface:

// Before (Commerce 14) - Storing credit card data directly
var payment = orderGroup.CreatePayment<ICreditCardPayment>();
payment.CardType = "Visa";
payment.CreditCardNumber = "4111111111111111";
payment.ExpirationMonth = 12;
payment.ExpirationYear = 2025;
payment.SecurityCode = "123";

// After (Commerce 15) - Using tokenized payment
var payment = orderGroup.CreatePayment();
payment.PaymentMethodId = paymentMethodId;
payment.TransactionType = TransactionType.Authorization.ToString();
payment.Amount = orderTotal;

// Store only the token from your payment provider
payment.Properties["PaymentToken"] = "tok_visa_4242";
payment.Properties["ProviderTransactionId"] = "pi_3abc123";

For more information about PCI DSS compliance requirements, see PCI Security Standards.