1

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to interact with that server? Will I be violating PCI compliance?

Improve this question
2
  • There are many PCI compliant apps on mobile platforms. What specifically are you concerned about?
    – Neil Smithline
    Oct 30, 2015 at 23:41
  • I am making a native app that will send a credit card number string (over https) to a 3rd party server. Do I need to be worried about PCI compliance or does the 3rd party?
    – mergesort
    Oct 31, 2015 at 3:07

2 Answers 2

Reset to default
1

You need to ensure the point to point connection between your app is compliant with pci dss (ie strong encryption etc.)and additionally you will need an attestation of compliance from the third party. They should have this if they are pci dss compliant.

Improve this answer
0

If credit card info touches your app/server in any way, you need to be PCI compliant. If the customer goes to the third party's site to enter cc info, it's their(third party site's) problem.

Improve this answer
3
  • It touches my app, but not my server. To make my app PCI compliant, I was just not going to store the credit card information locally and dispose of it as soon as it's used. Is there anything else I should be wary of?
    – mergesort
    Oct 31, 2015 at 14:43
  • You should read some of these documents then decide is it worth time to do. If it were me, I'd find a third party to handle credit card transactions.
    – N. Greene
    Oct 31, 2015 at 19:22
  • That's not a very helpful answer
    – mergesort
    Nov 1, 2015 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .