Member Avatar for upstream

Hi all,

I just want to ask how I can safely store credit card information in a database. My website only needs the information one time, but I can’t decide if I should store the credit card information in the database. I think I only need it one time, but I was thinking of a scenario wherein user will change his/her credit card info. >_<…any tips would help me a lot. Bdw, my payment scheme is recurring via PayPal Payment Pro.

Thanks!

  • 6 Contributors
  • 7 Replies
  • 210 Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by nelixinc

Dani AI

Generated

Short version for : avoid storing full card data if you can. The least-risk, most practical pattern for recurring billing is to vault/tokenize the card with your gateway and keep only the gateway token plus a masked last‑4 and expiry. Never retain the card verification value (CVV/CVC) after authorization — PCI rules forbid it — and using a vault moves most of the storage/risk off your systems. (studylib.net)

A quick correction to : hashing a PAN is one‑way and only useful for equality checks, not for charging. If you need to bill later, hashing won’t let you re‑use the card; tokenization or reversible encryption (with strict key management) is required. OWASP and industry guidance explain proper cryptographic choices and key handling. (owasp.deteact.com)

Practical minimal workflow (keeps you out of most of PCI scope): 1) collect card data via the gateway’s client‑side library or hosted fields so PAN never touches your server; 2) perform an initial auth/verification; 3) receive and store the gateway token plus masked last‑4/expiry and explicit customer consent; 4) immediately purge CVV and any raw PAN from logs/backups; 5) use the token for subsequent charges and for card updates trigger the hosted flow again. Major providers document these “save and reuse” flows and vault APIs. (stripe.com)

If you still consider keeping PAN yourself, be prepared for full PCI scope (SAQ D / QSA assessments), strong AES encryption, separate key vaults, rotation, tight access controls, and more — or adopt a PCI‑validated P2PE/vault solution to shrink scope and liability. Mask card numbers in UIs, never log sensitive fields, and get a QSA or your processor’s engineering team involved before touching card data. (bluefin.com)

Short, actionable takeaway: use gateway vaults/tokens for recurring billing; never store CVV; do not rely on hashing for re‑billing; encrypt and manage keys correctly if you must store PAN — otherwise outsource the storage to a validated provider.

Recommended Answers

All 7 Replies

Member Avatar for fionix

By the card association it isn't allowed to store card information other then part of the credit card numbers if it is encrypted and you are PCI compliant....

You can read much more about this topic at the official website about PCI compliance and card holder data protection, here is the link : https://www.pcisecuritystandards.org/

Member Avatar for zsaltzberg

If users check a box, such as on amazon, to "remember" their credit card information for future purchases, it is OK to store the information. It should be stored in a hash, including the CC# and expiration date. You should never under any circumstance store the CCID number.

Member Avatar for fionix

Yep it is okay, but still, if you store ANY credit card information what so ever, you have to be PCI compliant.... so care about it else it will cost you huge fines if something goes wrong.

Member Avatar for yollyP.

I'm still not at-ease in giving credit card information through the net, and any personal information whatsoever. How safe are the safety "nets" you are referring to here? Might be useful in my future dealings though.

Member Avatar for fionix

As long as the websites and the server it is hosted on is PCI compliant, and the compliance is maintained on a regular basis, then it is safe to key in your credit card information and other personal information.

Many websites will redirect the card holder to a “shared” or “secure” payment form which is hosted at the payment gateways end, and which (if the PSP is PCI compliant) is secure. In some cases and on large web shops it is sometimes of benefit for the website owner to integrate their website directly with the payment gateway which keeps the card holder on the website which then again will leave the card holder get a better experience in some cases.

However, since PCI hasn’t reached all websites and web shops on the Internet, then you will still find places which don’t redirect you to a secure payment form and which aren’t PCI compliant. This websites are unsecure and you should avoid them for any price. If they for any reason are unable to obtain a valid PCI certificate then you can be assured that it isn’t safe to enter your credit card information there.

I have seen many cases, where those website owners want to have the card holder to be kept on the Website/web shop without being redirected to any secure payment form, due to a more professional look and various other reasons, as they explain.

I even heard that some want to store the card information because they want to use it for marketing and fraud prevention. However at the end of the road they didn’t care about the security, people think that just because the card information is encrypted then it is safe to store it, to those people, you are SO WRONG, it take so much more to get the proper security implemented to avoid any security breach or even avoid hackers to get the information. It is a task which many think they can overcome but they quickly see that it will cost a few bugs to get it done and because of additional expenses they just leave it and pray that nothing happens or even just don’t care about it.

It isn’t that expansive for a website owner to get compliant and have the proper security and patches applied to your server, and you can find some low cost providers like hackersafe which will help you to be and stay complaint. In my opinion a few thousand dollars should be worth it.

Many people will try to tell you other stories and have found the key to a short cut, don’t believe them; you have to follow the PCI compliance regulations which I already provided a link for.

Member Avatar for Ancient Dragon

I'm still not at-ease in giving credit card information through the net, and any personal information whatsoever.

I'm with you -- I don't buy anything on the net unless that's the only way to get it. There are just too many instances of where huge company databases have been stolen by credit card thieves. If the datase is available on the net then its not safe.

Member Avatar for nelixinc

Some gateways will allow you to tokenize an initial transaction and use that token to run subsequent transactions. For example, you run an initial auth of a credit card for $1, and return a token that you store in your database. You immediately discard the credit card information. Whenever you need to run a transaction for a particular customer, you reference that token to run the transaction.

This allows you to rebill past customers and setup "one click" purchases for your customers. At the same time, you no longer store credit card information in your database. You don't have to mess with credit card encryption, and at the same time you satisfy many of the PCI requirements by simply not storing credit card information.

Our gateway supports this (you can read more at ) and we have example integration in a number of databases ().

I hope this helps!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.