Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does Paypal store credit card numbers?

Have they published any information this?

As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a personal guess.

share|improve this question
up vote 3 down vote accepted

This is most likely confidential, so I bet you won't get a 100% answer to this one. However, we know PayPal are PCI-DSS compliant.

This means they are compliant with 3.4 in the standard, which states: "Render PAN unreadable anywhere it is stored". That means with a probability of at least 99% that they store the credit card numbers encrypted. It is possible with compensating controls to store them unencrypted, but it's very difficult to get a compensation control to 3.4 approved by a QSA.

Regarding HSM, we must guess again. It is definitely possible to comply with PCI-DSS without using a HSM, it's just way harder. For a company with a small budget, they might want to avoid the cost purchasing a HSM. For a company like PayPal, it's a no-brainer, so I'm 99% sure they're using a HSM to manage their crypto keys.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.