Take the 2-minute tour ×

If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted.

To get it to the worker, however, it must be stored at least in RAM. How is it possible to do this but remain PCI compliant? This states:

3.2.2 Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.

Or is it impossible to be PCI compliant and use asynchronous workers?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

RAM is volatile and is not considered storage for PCI-DSS purposes - so long as the device that contains the RAM is otherwise PCI-DSS compliant.

In a similar fashion, temporary storage of the CVC/CVV on disc is not considered "storage" if the storage is highly volatile. For example, the operating system's swap space.

share|improve this answer
Can you point me to any sources, so I can show my colleagues? It looks like I was confused with the meaning of "storage", then. –  Ramon Tayag Sep 26 '13 at 4:30
"Storage" in PCI-DSS would have to mean persistent memory, otherwise all servers would need Homomorphically Encrypted RAM which would be profoundly more expensive than ECC RAM which is already quite expensive. Might as well has mandatory two-factor-auth credit cards in that case. –  LateralFractal Sep 26 '13 at 4:35
@RamonTayag An example in 1.3.7 of this doc. PCI-DSS does acknowledge memory scraping risks so you will need to secure the server in all the other ways. Also consider if direct PCI-DSS compliance is worth it. –  LateralFractal Sep 26 '13 at 4:41
Thanks @LateralFractal! You've been a great help. –  Ramon Tayag Sep 26 '13 at 4:47

Your Answer


