1

I am at a startup where we have chat support. Agents chat with customers and sensitive data may be transmitted during the chat session window. We store this sensitive data in our database for the duration of the session.

Once the chat session closes (either by the Agent or the Customer), we redact the sensitive data.

So, let's say a customer shares their CC# number during chat.

In our DB, we'd store 1111 2222 3333 4444 while the chat session is open.

Once the chat session ends, the stored CC data turns into <num> <num> <num> <num>

Is this sufficient for PCI compliance and/or protecting sensitive data?

  • Any thoughts on this? – Growler Apr 27 '17 at 22:51
  • Why do you need to store it in your database during the chat session? And is there anyway you can avoid collecting it in the first place? Either sending a link the user can click on to pay via a secure server, or taking the card number over the phone? – Bobson Apr 28 '17 at 1:17
2

The simple answer is no - that would most likely not be complaint with the requirements in PCI DSS. Sorry.

You may get two types of payment card data, the 15/16 digit cc numbers (PCI calls these PANs) and the CCV2 from the back of the card (This is a form of sensitive authentication data or SAD).

You can not store plaintext PAN in a database (ie on non-volatile storage) - it does not comply with Requirement 3.4 - Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches ...

Of course, you could have a long debate about "stored" and how many seconds something is on disk before it is "stored", but most assessors would equate any disk storage as stored (and also check log files). NB: If the DB is in RAM then it's not stored.

Additionally the receipt of PAN by "chat" can be problematic. If chat is a web app over TLS then that's OK. If it something like IRC or Skype then you have a problem with Requirement 4.2 - Never send unprotected PANs by end- user messaging technologies (for example, e- mail, instant messaging, SMS, chat, etc.)..

Hope this is helpful.

  • I should add that we're not a service that processes transactions/people's money. We simply happen to collect sensitive data sometimes on our servers. Since we do not process/handle payment data we shouldn't fall under PCI right? – Growler May 5 '17 at 17:30
  • Gosh that is a tough question because it falls into the contract complexity of PCI DSS and who is a service provider. Two questions: 1. Do you have a contract with people who do accept payment cards (ie merchants)? 2. Do they expect to receive payment card data over the chat system? If the answer to both question is yes then in PCI DSS terms you are a 'service provider' to the Merchant and would be listed in their section 12.8 list of service providers, and so yes you would be required to comply with PCI DSS. – withoutfire May 18 '17 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.