A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients.
I told him that I can build a asymmetrical (RSA) encrypted solution that would store the data and only he would be able to decrypt it if he has the correct key.
The private key would only be held by the client himself. So the system as a whole would not be able to decrypt the information at any point in time.
Would this be a legal solution? Since the data is always encrypted at rest, would this violate anything in regards to creditcards? The only way this could leak, is via the key of the client. If he keeps it say, would there be any trouble?