You can comply with PCI DSS by storing NO MORE THAN the first 6 and last 4 digits. You can also by-pass the requirements by storing a (somewhat non-reversible)

You can comply with PCI DSS by storing NO MORE THAN the first 6 and last 4 digits. You can also by-pass the requirements by storing a (somewhat non-reversible) hash of the entire card (or last x digits, in this case 5)... As long as the hashing and the storing is done on two separate systems. http://superconductor.voltage.com/2009/05/hashing-and-the-pci-dss.html http://superconductor.voltage.com/2009/05/hashing-and-the-pc...