We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data portal in which users can enter in their billing data (cardholder name, cvv, exp. date, street address, etc.) - now, the input fields for this are online, on the web app, but all of the data is stored locally on the end user's computer. When they click the submit button, the C# desktop app running locally on their computer recognizes it and encrypts then saves the billing data in JSON to a file in their local AppData folder.

This is a "sneaker bot", if you're familiar, that is essentially half-cloud based and half-local, but there does need billing data to be stored in this fashion so that it can be sent to other merchants upon client request, and so we can't use Stripe or Square, for processing transactions, because we aren't processing anything. Also, when this data is sent to other merchants, it is via local scripts, and that data is not transmitted online through our servers.

In short, would using input fields on a live web app to enter in credit card information and billing/shipping information okay if we do not do a post request, store it online, or save it, have billing-related, cookies, and that sort of thing? Would we still need to register as a PCI merchant and do the scans and all of that? Would this count as "handling" data?

Thanks. We know it's a bit of a weird situation. And yes, before you ask, sneaker botting is completely legal, at least in this fashion, although it usually involves somewhat obscure development strategies to weave around the potential necessity for storing card data and things of that nature.

1 Answer 1


There will be questions about handling of keys and potential client side attacks, etc. The only person who can give you a solid answer is a PCI-DSS QSA who understands enough implementation details to understand the data flows. I'm not a QSA but I've done enough PCI work to have an informed opinion.

My guess is that it does not count as 'handling cardholder data' from the perspective of your infrastructure, since in reality your servers don't see the data encrypted or otherwise (pls correct me if I understood incorrectly).

Also, in my personal view, it's unlikely this would be illegal, but it will have significant ramifications into PCI scoping, depending on how it ends up being implemented.

  • 1
    Thank you so much. Edit: (I accidentally hit enter instead of shift-enter the first time haha) Yeah so I do plan to consult a QSA but it's all handled client-side and stored locally. I'm not even sure a client-side attack could grab this data as it is not posted anywhere. Really the only way to do this would be seeing the client's screen or logging their keystrokes. Plus, even the code for this feature is all client-side and not on the servers. Thanks again for your time and feedback! I can post an update after talking to a QSA if anyone is curious or has this same obscure problem.
    – Anon109243
    May 5, 2020 at 18:05
  • To clarify, the question isn't whether or not it is illegal - that's not possible. The question is whether or not it would violate business agreements with the credit card companies and various processors. It's a contract matter, not a legal one. Oct 2, 2020 at 19:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .