Does Zencart Database save credit card details?

[sahail312]

Hi,

I'm using website pro and I'm a UK paypal user.

Just wanted to confirm whether customers details are stored on the zencart database using this module as the card type, expiry date and partial (8 digits) of the card number is shown on the order page.

So, is the full 16 credit card number stored or is it just the 8 partial numbers?

I need this information to complete the Privacy Policy.

Thanks!

[limelites]

Only partial numbers are stored on the ZC database.

[schoolboy]

Before you even think about storing CC details - even partial details - make sure you are aware of PCI compliance.

[dashequestrian]

Before you even think about storing CC details - even partial details - make sure you are aware of PCI compliance.

Hi

Is there any way of NOT keeping any of the CC numbers to avoid the need for PCI?

Cheers

Adam

[kuroi]

Is there any way of NOT keeping any of the CC numbers to avoid the need for PCI?

Fear not. Unless Schoolboy has knowledge of some specific change to the PCI requirements, I think you'll find that Zen Cart's core code has been very carefully crafted to ensure compliance.

And there are Zen Carts out there in the wild that have undergone external auditing to verify their individual compliance.

[Merlinpa1969]

even if you dont store cards,
If you use a servce such as linkpoint they still require pci complaince

[squashrick]

It looks like the PCI DSS compliance must have changed as the self-assessment questionnaire now includes an eligibility clause that asks you to confirm that 'Merchant does not store any cardholder data in electronic format' (see attached partial screen shot of the questionnaire).

Any thoughts/comments anyone?

[kuroi]

It looks like the PCI DSS compliance must have changed as the self-assessment questionnaire now includes an eligibility clause that asks you to confirm that 'Merchant does not store any cardholder data in electronic format' (see attached partial screen shot of the questionnaire).

Any thoughts/comments anyone?

Those questions are not assessing PCI DSS compliance. They're assessing which assessment path must be taken. Most retail stores don't collect or cardholder information electronically. Unless you sign up for a loyalty scheme, you pay your money and walk away with your purchases, so they don't need it.

Online stores usually have to store some cardholder information. Names and addresses are useful for delivery, and in case of payment or stock query. This doesn't disqualify them from PCI compliance. Just means that they have to take steps to protect that data and therefore the short version of the self-assessment form isn't appropriate.

[Merlinpa1969]

as long as you are NOT using the STOCK CC module ( shouldnt be using this in the first place )
and you didnt actually hit the store cc details using authorize net ( also NOT advisable ) then you are NOT storing numbers

therefor the short form is acceptable