REQU-06

Is the solution designed to process, store, or transmit credit card information?

Explanation

This question is asking whether your software solution is designed to handle credit card information at any point in its operation. This includes processing transactions, storing credit card numbers/details, or transmitting this information between systems. Why it's important: Credit card data is highly regulated under the Payment Card Industry Data Security Standard (PCI DSS). If your solution handles credit card data, it must comply with these strict security requirements to protect consumers from fraud and data theft. Organizations need to know if your solution handles payment card data because it introduces significant compliance requirements and security risks. The guidance clarifies that you should answer 'yes' if your solution handles PCI information in any way - whether directly (your system processes the actual card data) or indirectly (you use a third-party payment processor but card data passes through your system). Even if you use a third-party payment processor like Stripe or PayPal, if credit card information flows through your solution at any point, the answer is 'yes'. When answering this question, be specific about: 1. Whether your solution handles credit card data at all 2. If yes, how it handles it (processing, storing, transmitting) 3. Whether you handle the data directly or use third-party services 4. What PCI DSS compliance measures you have in place if applicable

Guidance

Answer yes if your solution handles PCI (credit card) information, either directly or via a third party.

Example Responses

Example Response 1

Yes, our solution processes and transmits credit card information We operate as a payment gateway for e-commerce websites Our system receives credit card details from customers during checkout, encrypts this data in transit and at rest using AES-256 encryption, and transmits it securely to payment processors for authorization We maintain PCI DSS Level 1 compliance (the highest level) and undergo annual third-party audits We do not store full credit card numbers after processing; we only retain the last four digits and tokenized references for recurring billing purposes.

Example Response 2

No, our solution does not process, store, or transmit credit card information For payment functionality, we integrate with Stripe's payment processing system using their JavaScript checkout solution that redirects users to Stripe's secure environment This implementation ensures credit card data never touches our servers or systems The payment flow is designed so that all credit card information is entered directly into Stripe's forms, and only non-sensitive transaction confirmation data (such as approval status and transaction IDs) is returned to our application.

Example Response 3

No, our solution is not designed to process, store, or transmit credit card information While our e-commerce platform does facilitate online purchases, we've implemented a redirect-based integration with PayPal where all payment processing occurs entirely on PayPal's systems However, we should note that we are currently developing a new feature that will allow customers to save credit card information for faster checkout Once this feature is launched next quarter, our answer will change to 'Yes' and we will complete PCI DSS certification before releasing this functionality.

Context

Tab: Case-Specific
Category: Required Questions