Well thats a given since your merchant bank and processor will force you to be PCI compliant including annual reviews. PCI compliance doesn't specify where you

Well thats a given since your merchant bank and processor will force you to be PCI compliant including annual reviews. PCI compliance doesn't specify where your private key is stored just that your data is in a "unreadable" state and that you have certain key management procedures in places. For example, hashing your credit cards is acceptable though it can easily be brute forced since its just 16 digit number and the six digit prefix set(BIN) is already known.