First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to do this.
Here's the scenario:
- A standard marketplace setup with vendors selling their own items and customers purchasing them.
- Storing customer card details upon checkout
- Later displaying a customers full card details to vendors who can then process the transaction via their own methods
- All whilst following PCI compliance for this particular setup
Would one be breaking PCI compliance in any way and/or would this be putting the vendors at any sort of risk?
Also, are the any third-party services that would take care of storing the card data to then get via something like a web-hook? (stripe etc only return the last 4 digits)