Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We are in situation where our application receives a payment confirmation from a third party service, which includes an encrypted credit card number too. Our application needs to store the response. Other than that, in any way we not using the credit card number. The third party application is PCI certified.
(This question was first asked at Stack Overflow.)
From PCI-DSS 3.2 Applicability Information:
PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers.
PCI DSS also applies to all other entities that store, process, or transmit cardholder data and/or sensitive authentication data.
The card number (Primary Account Number or PAN) must be rendered unreadable when storing it, in any situation. The fact that you receive it encrypted isn't relevant.
One big question here is: What are you? Are you a merchant? A service provider? A payment application provider? (this last one seems unlikely, from the info you gave)
PCI-DSS is a security standard. AFAIK, it is not required by any government regulations, but rather by payment processors. So, if you're not accountable to a payment processor, and it's not something you want to have for your clients (in the case you're a service provider), no one is forcing you to be PCI-DSS certified.
If you are a merchant, then the exact requirements are set by your payment processor. For example, here are Visa's requirements for their merchants, in regards to PCI-DSS compliance.
I would also ask yourself if you really need to store the PAN. What purpose does the encrypted PAN serve for you?
under the assumption that the data is encrypted using strong crypto and you do not have the encryption key or an interface in the system that can de-crypt it than your app is out of scope
