The CGI and the server pass information back and forth using Triple-DES and digital key encryption technology. The data stream is extremely secure, since keys are negotiated on a per-transaction basis. The ONcommerce server resides on our Transaction Proxy server, which is connected to the Internet but only allows communications on a single port. This eliminates vulnerabilities that arise from the normal UNIX behavior of allowing connections on any socket or port.
Most security holes rely on the server running sendmail, a news server, or other well-known daemon.
The Transaction Proxy server runs nothing aside from the ONcommerce server. The transaction information is passed from the Proxy server to the actual server running the credit card transaction software via a private network. The computer that actually contacts the bank or clearinghouse and processes the transation is separate from the Internet and is impregnable to attacks from it. Once your customer's and your information are passed to the workstation, the transaction is cleared in a matter of seconds, and the results are passed back to the proxy server. The ONcommerce server then passes the results of your transaction back to the waiting CGI, at your site.