Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Not completely au fait with PCI compliance, however we have our server checked each month by our host to check it is PCI compliant, because we have to keep it PCI Compliant for a specific customer/service that we have running on it.

We have another service on the same server/system that creates images containing customer data (name/address)

We want those images to be accessible in another system's template... the third party system is secure (SSL cert). How do we make the images available without breaking PCI compliance ? Eg. We want to allow the other system to do something like this :

If we did that would we be breaching PCI compliance ? Any alternative solutions or thoughts are extremely welcome...


Clarification It's actually the same service that has different components, sorry for the miss-explanation.

share|improve this question
Sounds like you may already be having trouble with PCI 2.2.1. In any case generally you want to keep your PCI scope as small as possible, which would imply you don't want anything running in your CDE that doesn't stricly need to be. – bobince Oct 1 '13 at 8:00
Could you clarify, it sounds like the "images containing customer data" are for customer data that's unrelated (for another customer?) to the "specific [PCI compliant] customer/service"? If so, ++vote for what @bobince said about violating 2.2.1. – gowenfawr Oct 1 '13 at 14:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.