My client wants to Store Credit Card numbers encrypted in the database on the server

[Tech-E]

PCI has differant levels for different ranges of Transaction, and you only have a be compliant if you store the CC data, most stores done, so they dont have to worry, but if you are staring number after jan 1 2008 you better be PCI compliant or face Fines or Suspension of your CC processing Privileges

OK, that makes sense. I plan to use Authorize.net for a new store. My merchant account bank (an Authorize.net partner) requires an audit of my site, but PCI compliance has not been raised as an issue. They seem to be more concerned about SSL and return policies.

[Tech-E]

I found a link on the Authorize.net site that points to a page that defines the merchant levels for compliance.

trustwave.com/pciDataSecurityStandard.php