I'm in charge of security for a small online store that wishes to request credit card information, but not actually charge the customer until approximately a month after the purchase - this cannot be avoided.
However, it seems to be a nightmare for compliance purposes. It seems as if we'd need to store the credit card details for some time until we charge the customer, possibly necessitating pci-dss compliance. We have no use for the numbers after that month-ish long period.
Does this setup necessarily entail pci-dss compliance? If it doesn't what alternatives are there to securely manage that information on this time scale?