PCI Complient Storing Credit Card Data On Offline Tablet

Question

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where they can charge the client.

I have fairly significant background in databases, networking, and programming, but I have never written a system that stores credit card information.

The data will be encrypted with AES, stored in a database on the tablet, and then later in the day deleted from the tablet once it has been brought back to the office.

Given that this is all offline, and never connected to the internet does this fall under the scope of the PCI standards, is this acceptable, or should I advise my client to look at other options?

Answer 1

As you can read in the PCI_DSS bullets 3.1 and 3.2 you can store this information if it is needed by your business.

You will find in the point 3.2.1 the information you need to store, and as you can read in 3.1.1 as long as you have politics and procedures to treat the information securely and delete it in a secure way, your system will be PCI_DSS compliant.

In the section 3.5 you will find also the rules you must to follow to ensure the password/key you use to cypher/decypher are used in a safe way.

Long story short, as long as you manipulate the credit card information in a secure (and normative) way and store it only the time needed to use them, there is no problem in doing so.