0

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe for payment.

So should we go ahead with PCI - DSS compliance?

Improve this question
1
  • 1
    Uh, Stripe allows for tokenized cards, which is what you should be using. Attach it to a Customer object if you really need to reuse it. If you can get the tokenization to happen client-side, PCI-DSS pretty much completely goes away. As near as I know, tokens are specific to your merchant id, so there's no issue around leaking them - but I could very well be wrong about that last bit.
    – Clockwork-Muse
    Commented Dec 24, 2018 at 19:42

1 Answer 1

Reset to default
1

Yes - if you store, process or transmit cardholder data you need to comply with PCI DSS.

I’d really question your decision to store the 16-digit PAN (credit card number) in the database - Stripe has some great options that may enable you not to do this, criminals love databases containing cardholder data.

Improve this answer
1
  • Yeah I know the security risk. But the client wants this.
    – Sameer Shaikh
    Commented Dec 25, 2018 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .