Page 1 of 1

Does increasing the default CC# storage time violate PCI?

Posted: Thu Dec 04, 2008 10:59 am
by SteveHiner
My client doesn't like the default 60 (or is it 30?) day storage for credit card numbers. He wants it increased to a year or more. I've looked over some of the PCI stuff and don't see that it's a problem (at least as far as compliance goes). I've told him that I don't think it's a good idea but, obviously, Amazon stores CC numbers basically forever and they're certainly at a higher certification requirement than my client.

Any advice/guidance?

Re: Does increasing the default CC# storage time violate PCI?

Posted: Wed Dec 10, 2008 7:08 pm
by kastnerd
I think its 30 days total? or 30 days from last order? 6 months from last order sounds like a good max.
But amazon, newegg and paypal do keep your credit card on file for a long time.

Re: Does increasing the default CC# storage time violate PCI?

Posted: Tue Aug 18, 2009 2:02 pm
by igavemybest
http://www.pcicomplianceguide.org/merch ... liance.php

There is some great info there, and it is not an issue from anything that I see.

Re: Does increasing the default CC# storage time violate PCI?

Posted: Fri Nov 18, 2011 5:23 pm
by Lucin
Yes I agree, I think you should stick with 6 months as a maximum mark to be on the safe side. You can advise your client on why this is the case if you like. Hope that helps.

biotin side effects,viviscal review for the hair.
"There are only two mistakes one can make along the road to truth; not going all the way, and not starting."

Re: Does increasing the default CC# storage time violate PCI?

Posted: Fri Nov 18, 2011 9:46 pm
by rymay
Lucin wrote:Yes I agree, I think you should stick with 6 months as a maximum mark to be on the safe side. You can advise your client on why this is the case if you like. Hope that helps.

biotin side effects,viviscal review for the hair.
"There are only two mistakes one can make along the road to truth; not going all the way, and not starting."

I read a bit more on this and it seems that you don't necessarily need to stick with the 6 month benchmark. I am not 100% sure though.