This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
Understand the payment boundary
A hosted or tokenised payment integration can reduce the need for your site to handle card details. The exact compliance responsibilities depend on the provider and integration; an external checkout alone is not a compliance certificate.
- Use an established payment processor and follow its implementation guidance.
- Avoid storing card numbers or security codes in your own website database.
- Protect payment configuration, API keys and webhook endpoints.
Make booking states reliable
Availability checks, payment status and confirmation messages should be consistent. A temporary reservation should expire predictably, and a successful payment should not create duplicate bookings.
- Validate inputs on the server rather than trusting browser controls alone.
- Ensure automated emails distinguish confirmed, pending and failed payments.
- Verify payment notifications using the provider’s supported authentication method.
Protect administration and customer information
Use least privilege, secure sessions, access logging and tested restore procedures. Minimise data collection, publish truthful privacy information, and define who has access to booking records.
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Protecting devices, systems and networksASD’s Australian Cyber Security Centre · 7 October 2026
- Secure your websiteASD’s Australian Cyber Security Centre · 1 July 2020 (reviewed 29 July 2024)
- Small business cyber security handbookASD’s Australian Cyber Security Centre · 7 October 2026
