I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where they can charge the client.
I have fairly significant background in databases, networking, and programming, but I have never written a system that stores credit card information.
The data will be encrypted with AES, stored in a database on the tablet, and then later in the day deleted from the tablet once it has been brought back to the office.
Given that this is all offline, and never connected to the internet does this fall under the scope of the PCI standards, is this acceptable, or should I advise my client to look at other options?