We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : http://securology.blogspot.in/2008/12/stupidest-pci-requirement-ever.html
"Consider an automated e-commerce system. The notion of automation means it works on its own, without human interaction. If that e-commerce system needs to process or store credit card numbers, it will need to encrypt and decrypt them as transactions happen. In order to do those cryptographic functions, the software must have access to the encryption key. It makes no sense for the software to only have part of the key or to rely on a pair of humans to provide it a copy of the key. That defeats the point of automation."
.. so we can't process payments automatically on monthly billing date using the stored cardholder data? Do we both have to enter keys for EVERY transaction, thats just impossible right?
