How does Paypal store credit card numbers?

Have they published any information this?

As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a personal guess.


This is most likely confidential, so I bet you won't get a 100% answer to this one. However, we know PayPal are PCI-DSS compliant.

This means they are compliant with 3.4 in the standard, which states: "Render PAN unreadable anywhere it is stored". That means with a probability of at least 99% that they store the credit card numbers encrypted. It is possible with compensating controls to store them unencrypted, but it's very difficult to get a compensation control to 3.4 approved by a QSA.

Regarding HSM, we must guess again. It is definitely possible to comply with PCI-DSS without using a HSM, it's just way harder. For a company with a small budget, they might want to avoid the cost purchasing a HSM. For a company like PayPal, it's a no-brainer, so I'm 99% sure they're using a HSM to manage their crypto keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.