I am at a startup where we have chat support. Agents chat with customers and sensitive data may be transmitted during the chat session window. We store this sensitive data in our database for the duration of the session.
Once the chat session closes (either by the Agent or the Customer), we redact the sensitive data.
So, let's say a customer shares their CC# number during chat.
In our DB, we'd store
1111 2222 3333 4444 while the chat session is open.
Once the chat session ends, the stored CC data turns into
<num> <num> <num> <num>
Is this sufficient for PCI compliance and/or protecting sensitive data?