If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted.

To get it to the worker, however, it must be stored at least in RAM. How is it possible to do this but remain PCI compliant? This states:

3.2.2 Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.

Or is it impossible to be PCI compliant and use asynchronous workers?

1 Answer 1


RAM is volatile and is not considered storage for PCI-DSS purposes - so long as the device that contains the RAM is otherwise PCI-DSS compliant.

In a similar fashion, temporary storage of the CVC/CVV on disc is not considered "storage" if the storage is highly volatile. For example, the operating system's swap space.

  • Can you point me to any sources, so I can show my colleagues? It looks like I was confused with the meaning of "storage", then. Sep 26, 2013 at 4:30
  • "Storage" in PCI-DSS would have to mean persistent memory, otherwise all servers would need Homomorphically Encrypted RAM which would be profoundly more expensive than ECC RAM which is already quite expensive. Might as well has mandatory two-factor-auth credit cards in that case. Sep 26, 2013 at 4:35
  • @RamonTayag An example in 1.3.7 of this doc. PCI-DSS does acknowledge memory scraping risks so you will need to secure the server in all the other ways. Also consider if direct PCI-DSS compliance is worth it. Sep 26, 2013 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .