0

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe for payment.

So should we go ahead with PCI - DSS compliance?

  • 1
    Uh, Stripe allows for tokenized cards, which is what you should be using. Attach it to a Customer object if you really need to reuse it. If you can get the tokenization to happen client-side, PCI-DSS pretty much completely goes away. As near as I know, tokens are specific to your merchant id, so there's no issue around leaking them - but I could very well be wrong about that last bit. – Clockwork-Muse Dec 24 '18 at 19:42
1

Yes - if you store, process or transmit cardholder data you need to comply with PCI DSS.

I’d really question your decision to store the 16-digit PAN (credit card number) in the database - Stripe has some great options that may enable you not to do this, criminals love databases containing cardholder data.

  • Yeah I know the security risk. But the client wants this. – Sameer Shaikh Dec 25 '18 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.