1

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form online where customers/businesses enter bank account information, as well as social security numbers. He wants this form to be emailed to our financing group to process. Instead of emailing this form, could I keep the data on my SSL server and encrypt it some way then provide a login link for our financing group to use, enter a key, then display the sensitive information? We are trying to eliminate the need to fax or mail an application.

We have 2 servers, an in-house MS SQL 2008 server and a MySQL/nginx server WordPress is installed on.

After reading through many posts, what my client wants to do is a huge risk for users and our company. I'm not a security specialist, just looking for some feedback on what I should/could do.

Thanks in advance!

  • 5
    Honestly, this is a situation where I'd say, if you don't know how to do it, you shouldn't be building it. My advice is to contract a company that actual has experience in building these types of systems. Storing privacy sensitive data, such as social security number. Walk away. – Lucas Kauffman Nov 11 '14 at 22:17
  • I would agree with @LucasKauffman There is a huge risk involving sensitive data, It might be worth it to use a possible APi to make this work correctly since its a WP. But don't up the creek without a paddle – Cameron Verotti Nov 12 '14 at 0:33
  • @LucasKauffman Yeah I was thinking the same. I want to eventually learn how to properly secure this kind of data but at this moment in development, it would be a nightmare trying to do this myself. – fryvisuals Nov 12 '14 at 20:09
0

As per Lucas's comment, you really do not want to do this unless you know how to do it.

Storing account details and SSN's brings legal and regulatory requirements - including:

  • strong encryption
  • regular penetration testing
  • audits

And so on.

There are many payment providers who will do this for you, meeting PCI DSS requirements etc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.