Assume the payment server gets hacked: hardening a self-hosted crypto gateway

When you take card payments through a hosted provider, server security is mostly someone else's problem. Your shop never sees a card number, and the money sits with the provider until it pays you. Run