The C# program I have created uses a webdriver to send the user's card number and other info such as their address to a store page, I never save the number in code other than when it is stored in memory. The user has to enter all of their data every time the program opens; is this a secure approach? (I'd assume not) What can be done to improve this? I don't think I would need keys because the webdriver imitates a keyboard and never communicates with a server. Also the program opens Firefox and uses it to access the website.

Also I don't know if this is the correct forum to ask this but what wording would I use in a privacy statement on my website selling this program? "We value the customer's security here at x, so we never get access to your personal info other than email address (for verification)." Is along the lines of what I was thinking.


All merchants who accept credit card information must be in compliance with PCI-DSS. This is true even if you pass the credit card information to another service for processing. However, it sounds like you would qualify for minimal the compliance level ("Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced", or level A). To see how you are doing, you can fill out the self-assessment questionnaire for level A, or SAQ-A.

if an ecommerce merchant only accepts credit card payment via their website and does not handle, process and store credit card data by using an API like ours or a hosted page, the merchant can qualify for the SAQ A, the shortest of the four.

If you meet the minimum requirements of PCI-DSS, your program will be reasonably secure.

| improve this answer | |
  • Considering they're running a local program that keys the data into a web page, they likely wouldn't qualify as an e-commerce merchant. Whatever computer runs that program would be in scope for PCI as it directly impacts the security of the cardholder data. – John Downey Mar 20 '17 at 19:20
  • I sell the program through shopify which would classify me as level A but after that the user enters their info to the program which then is sent to the website so the user can buy from them. The line "company does not electronically store, process, or transmit any cardholder data on your systems or premises, but relies entirely on a third party(s) to handle all these functions;" from that pdf makes me think I wouldn't be level A anymore as even though my servers do not handle their info, the program I sold does. I store offline in memory while program is open until its fed to the website. – Chase Mar 21 '17 at 14:50
  • Ok I just thought of a way to clarify that comment. Would a program I develop, then sell to the customer (which briefly stores their data in pc memory and never communicates it to me again) be considered my premises or the customer's? – Chase Mar 21 '17 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.