We are a small company and process less than 500 Credit Card transactions each year so we fall under Level 4 category merchants. The company heads wants to make sure that we are PCI compliant at all levels. I see that we are storing the credit card data in one of our databases but the PAN number is encrypted using RC2 encyption when it was initially developed years ago. I still feel that the RC2 encryption is vulnerable to attacks though we use SSL connection to transmit the data.

I have a few things in my mind as follows.

  1. Tokenization
  2. Removing Card data from our database and only transmit details to the payment gateway.
  3. Secure Key Storage for the encrypted card Data.

I checked with the business and they said that the option 2 to remove card data is fine as they do not need to store data, but since there are some recurring transactions, my question is will that be affected if card data storage is removed??

If I go with option 3 of securing the keys used to decrypt the data, I see that there is a lot of procedures that needs to be followed as to implementing a commercial key management system etc.

Can you please suggest as to what is the best way of getting around this and be compliant.

1 Answer 1


The best over all solution is to use a commercial payment handling service that deals with all of that for you. For that transaction volume, the danger of having card data stored on prem out weighs your need for the data.

If this is a retail business, I would suggest something like square, which would essentially put the responsible handling of data in their court, and their rates are very friendly to the small business world in comparison to other options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .