4 ms·
This would be a PCI violation, so if it's common, then someone has some calls to make. I'm a stickler about enforcing data retention (and non-retention) standa
by dibujante 11y ago
This would be a PCI violation, so if it's common, then someone has some calls to make.
I'm a stickler about enforcing data retention (and non-retention) standards where I work. We never store any credit card information. That would be an outrageous liability.
- phonon 11y agoStoring the PAN is not a "PCI violation". It's not best practice, for sure, and you then have an obligation to secure your systems much more thoroughly, but you can do it. "Payment brand rules allow for the storage of primary account number (PAN), expiration date, cardholder name, and service code." https://www.pcisecuritystandards.org/documents/SAQ_InstrGuidelines_v3-1.pdf https://www.pcisecuritystandards.org/documents/SAQ_InstrGuid... (There are other types of data you can NEVER store (also described in the above document) like the CVV or PIN code, which is perhaps what you meant.)