I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the background check service that we are using. They require all API calls to include basic credentials. (A username and password)
I can basically see two options:
Make the call to the background check API from the browser...but that puts those API credentials IN the browser....not good at all. Somebody could go through our completed background checks. Lots of sensitive info there! (This is fairly unlikely...but possible nonetheless)
Send the information to my server, which will pass it on to the background check API....but that means a SSN is on my server for a brief amount of time. (Barring any logging that I'd need to unhook)
I am leaning towards the latter, especially since I've been told a mobile app will be in the future. That begs the main question: What is the correct way to treat a SSN that is simply passing through a server on its way somewhere else?