1

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over to a third-party via a secure channel (https); but not stored at all in the application.

Update: We will not be taking payments through the app, just provide a form for users to register their cards. Future request to the third-party include the userId and an authorization field.

Do I need PCI compliance in this case?

3
  • 4
    In theory yes, and you might need to be PCI level 3 (which is self certified). The main thing to prove will be that you have a code review process in place and that the application hasn't been changed since the point is compiled until it's published on the stores. As a side note, I don't think you can receive payments on iPhone/iPads (as apple takes a 30% cut).
    – Augusto
    Sep 4 '14 at 9:18
  • @Augusto how did you figure that they would be Level 3? The PCI Levels are based on volume of annual transactions, with Level 3 being (in Visa terms) 20k-1m annual Visa transactions. In their post they said nothing about payment volume. Sep 10 '14 at 10:49
  • It is a guess from I plan to build an Android/iPhone app (no offence)
    – Augusto
    Sep 11 '14 at 18:14
3

Any merchant accepting payments, regardless of the method, needs to be PCI compliant. To accommodate the various methods of accepting payment (outsource, redirect, iframe, POS, etc.) the PCI council has developed different self assessment questionnaires (SAQ). The SAQ forms are essentially a paired down list of requirements from the full PCI DSS. The requirements included in each of the SAQ forms are those that are most applicable to the way you accept payments.

Based on the method of processing you implement you will need to select the proper SAQ form, make sure you meet all the requirements list, and then complete the SAQ and Attestation of Compliance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.