We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : http://securology.blogspot.in/2008/12/stupidest-pci-requirement-ever.html

"Consider an automated e-commerce system. The notion of automation means it works on its own, without human interaction. If that e-commerce system needs to process or store credit card numbers, it will need to encrypt and decrypt them as transactions happen. In order to do those cryptographic functions, the software must have access to the encryption key. It makes no sense for the software to only have part of the key or to rely on a pair of humans to provide it a copy of the key. That defeats the point of automation."

.. so we can't process payments automatically on monthly billing date using the stored cardholder data? Do we both have to enter keys for EVERY transaction, thats just impossible right?

1 Answer 1


You CAN use stored keys and DO NOT have to enter keys manually, but you also must rotate (change) keys every quarter, and a separate key for each customer is a good idea, too.

  • Ah, I just let out a biggest sigh! :) So what if we didn't store the keys at all and just manually entered them on application startup? btw, some authoritative reference if possible would be great.
    – Nimbuz
    Dec 16, 2012 at 3:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .