Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've looked at a number of question/answer threads and docs about PCI compliance, including various results on Google and have not found a definitive answer to this question:

Does a web app fall under PCI compliance rules/regs if it collects the bank account-routing number combination via a web form and passes it along to a 3rd party for persistence/validation (assuming that it also logs the web requests in transit)?

share|improve this question
    
If all you are doing is storing the rounting number, that information is public, the banks provide this information on their own. If you are storing the user's bank account number then you should treat it as PII, because the only information require to make a withdraw, is the checking account number and the rounting number. The fact you are asking this question means you have no business collecting this information because, YOU WILL store it in an insecure way, because your asking if it calls under these compliance rules. –  Ramhound Jul 10 '12 at 12:14
    
DO NOT collect this information, DO NOT store this information in plain text, otherwise the information WILL be leaked eventually and every single one of those accounts will be at risk. –  Ramhound Jul 10 '12 at 12:15
add comment

1 Answer

up vote 2 down vote accepted

Since PCI stands for Payment Card Industry the short answer is no.

However that information is sensitive so you should treat it like any other sensitive data and store and transmit it in a secure, encrypted form.

PCI is a great baseline for dealing with any secure data so it certainly wouldn't hurt to treat it the same.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.