Skip to main content
HOA guarantees security for the following reasons:
  • Vindicia receives data submitted by the order form over HTTPS (a secure HTTP connection using Transport Layer Security (TLS)).
  • HOA tracks an order-form submission through a WebSession object, which is created on the Vindicia server before the order form is presented to your customer. This allows you to preload information, including the IDs of Subscribe objects to which the order refers (such as an existing BillingPlan or Product object), without displaying the information on the form.
  • A WebSession object has a 40-character unique ID, which is included as the session ID in the form. This ID expires, 1) after a form is submitted using that ID, 2) after 1 hour (3600 seconds, the default expiration time), or 3) after an expiration time you configure, whichever occurs first. This prevents illegal or repeated use of session IDs by hackers. HOA stores the results of the API call in the Subscribe WebSession object. You fetch this object and, based on the results, determine the next steps the customer should take on your site.
Except for iframes, Vindicia does not host any HTML pages in the process. Your customers might notice Loading https://secure.vindicia.com....in the status bar of their browser, but only momentarily during iframe load, after submitting the Web order form, and before HOA loads your redirection page. Your order form and success or failure pages, with your branding style, are the only pages visible to your customers. HOA does not make the API call to create objects containing sensitive payment information, such as an AutoBill or a PaymentMethod object, until you finalize the WebSession object (call Websession.finalize()) from the success page that you host. Therefore if the connection is lost while HOA is redirecting the customer’s browser from the Vindicia server to your server, your success page will never be reached, the WebSession will not finalize, and HOA will not make the API call. This approach preserves data integrity in cases of connections dropped during the processes For pure Ajax (asynchronous JavaScript and XML) solutions, you will have to call your own success or failure back-end function. See Using Hosted Fields with Ajax onSubmitCompleteEvent for details. Note: Vindicia never returns or displays sensitive payment information, such as credit card account numbers, in full. When returning information through an API call, or displaying the data in the Portal, Subscribe always partially masks account numbers. Parent topic:Hosted Order Automation with Hosted Fields