EDIT: This is for the UK/Europe region.
I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be plaintext in a database, as they are publicly available. I'm concerned about storing the account number however. I also know that you cannot really get anything from a bank account with just the routing and account numbers.
I know that this information does not fall under PCI standards. We currently have a hosted business web application and database on the same server, and we would like to store some account details here for some of our employees to refer to when doing invoices, etc. We do have a fully enabled role/permission based system, so we can limit who this information is available to.
My main concern is our mail shots for this information. AFAIK, we have to send a confirmation letter to the customer when any part of their account changes (such as collection dates, etc.), or they make a new one. On this letter, the bank account number should appear. We also want this information to be available to the customer on their online portal account (built by us). Is it safe to store the account number as-is (plain), and ONLY include the full number on the paper letter? The online version could be partially or fully obscured by the server, so that it never appears in-browser.
Or am I over-thinking this and going too far? OR would it be better to just walk away from this and stress the word NO to my superior?