1

I am at a startup where we have chat support. Agents chat with customers and sensitive data may be transmitted during the chat session window. We store this sensitive data in our database for the duration of the session.

Once the chat session closes (either by the Agent or the Customer), we redact the sensitive data.

So, let's say a customer shares their CC# number during chat.

In our DB, we'd store 1111 2222 3333 4444 while the chat session is open.

Once the chat session ends, the stored CC data turns into <num> <num> <num> <num>

Is this sufficient for PCI compliance and/or protecting sensitive data?

Improve this question
2
  • Any thoughts on this?
    – user3871
    Commented Apr 27, 2017 at 22:51
  • Why do you need to store it in your database during the chat session? And is there anyway you can avoid collecting it in the first place? Either sending a link the user can click on to pay via a secure server, or taking the card number over the phone?
    – Bobson
    Commented Apr 28, 2017 at 1:17

1 Answer 1

Reset to default
2

The simple answer is no - that would most likely not be complaint with the requirements in PCI DSS. Sorry.

You may get two types of payment card data, the 15/16 digit cc numbers (PCI calls these PANs) and the CCV2 from the back of the card (This is a form of sensitive authentication data or SAD).

You can not store plaintext PAN in a database (ie on non-volatile storage) - it does not comply with Requirement 3.4 - Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches ...

Of course, you could have a long debate about "stored" and how many seconds something is on disk before it is "stored", but most assessors would equate any disk storage as stored (and also check log files). NB: If the DB is in RAM then it's not stored.

Additionally the receipt of PAN by "chat" can be problematic. If chat is a web app over TLS then that's OK. If it something like IRC or Skype then you have a problem with Requirement 4.2 - Never send unprotected PANs by end- user messaging technologies (for example, e- mail, instant messaging, SMS, chat, etc.)..

Hope this is helpful.

Improve this answer
2
  • I should add that we're not a service that processes transactions/people's money. We simply happen to collect sensitive data sometimes on our servers. Since we do not process/handle payment data we shouldn't fall under PCI right?
    – user3871
    Commented May 5, 2017 at 17:30
  • Gosh that is a tough question because it falls into the contract complexity of PCI DSS and who is a service provider. Two questions: 1. Do you have a contract with people who do accept payment cards (ie merchants)? 2. Do they expect to receive payment card data over the chat system? If the answer to both question is yes then in PCI DSS terms you are a 'service provider' to the Merchant and would be listed in their section 12.8 list of service providers, and so yes you would be required to comply with PCI DSS.
    – withoutfire
    Commented May 18, 2017 at 8:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .