That's what's funny about PCI scope. The JS is controlled by the server, so that the server doesn't presently see the card number, should be irrelevant. I assu

That's what's funny about PCI scope. The JS is controlled by the server, so that the server doesn't presently see the card number, should be irrelevant. I assume exposure is equal to passing the card to a merchant gateway on the backend as it is for passing the card to a merchant gateway on the frontend. It's nonsensical to assume the threat profile on the two are any different. Certainly it matters if the backend is storing the card number in any way. Or if the backend is transmitting the card number in any way beyond the established TLS channel. The card number be encrypted as quickly as possible and shoved off. I always find the best place to do it is on the backend. If you can afford it, you get the PCI audit anyway, because not having it is just an excuse to be sued, right?