Safe place to store credit card numbers?

Velvis

Velvis

Well-Known Member
Reaction score
46
Location
Medfield, MA
A non profit client of mine reached out about wanting to know if storing CC #, and SS# of their donors in Google Drive is safe.

Now right off the bat to me it sounds insane and not safe, but also a huge liability. But this isn't exactly my wheelhouse.

I'm not sure why they would want to store that info but I figured I'd check here to find out 1) the long list of why not to store that info anywhere and 2) If there was a safe alternative I could suggest.
 
Cloud storage is no more or less safe in Google Drive than OneDrive, etc.

But, there is no way I'd save this in any file on any drive unless the file itself is encrypted at the very least. Cloud storage is all, to my knowledge, encrypted at the drive level as well.

I can imagine why they might want to save credit card numbers if the donors are doing annually-renewable recurring monthly donations, but I can''t even conceive of a reason why a non-profit would want to have SSNs for donors. That's just unwise (and potentially illegal).

And whatever they save, and however they save it, they'd better be able to document who had access and when to that sort of sensitive information.

And I would discourage them from keeping it, period, if whatever they use to manage their donations deals with the credit cards "as ordered" after the initial data is entered.

If every there were a case where Mies van der Rohe's dictum, "Less is more," applies, this is it!
 
Sky-Knight said:
My password manager has a CC storage system, that's as "cloud" as I get with such things.
Click to expand...

But that's for your own credit cards, isn't it? What I might do with my own credit card numbers would differ (somewhat to a great deal) from what I would do for a donor list.

And I'm with those who say that keeping this data, and particularly in conjunction with SSN data linked to it, is a spectacularly bad practice and an accident just waiting to happen. All the more so when we're talking about a non-profit as the information holder, and probably a small non-profit at that. The legal exposure were any "accidents" to happen is just huge and without a massive legal department for protection such as those that outfits like Anthem, Equifax, and similar have to insulate them.
 
100% offload CC as much as you can. We have two standalone IP terminals at different sites and that's a hassle enough doing SAQ B-IP and quarterly scans. Even the SAQ B-IP covers questions about storing cardholder data (which we don't do in any way).
 
The problem ISN’T the cloud services. They are compliant, your client probably isn’t. Even if they store the information on a local server. They need to be audited and make the necessary changes, which can use cloud services. Or they need to subcontract that out to firms that handle the information for them. There’s a whole industry available for nonprofit organizations to handle donations and the PCI data for them. For most small organizations that is the best and most affordable way to go.
 
On further questioning they want to be able to send/receive ss# and cc# via email.
Is there anyway to do that securely?
 
I use QuickBooks Online. Very easy to store the credit card for a customer. I can't see it, but can access it at any time to apply it to payment of an invoice or set up recurring payments.

Trying to find any other way to keep them yourself is just crazy talk.
 
timeshifter said:
I use QuickBooks Online.
Click to expand...

I am not trying to be snarky here, but how is keeping them in Quickbooks online not "keeping them yourself"?

It does appear that they have an effective way of masking that data yet still making it accessible to you, but in the end you are the one who is maintaining the database.

Of course, if what Quickbooks Online does for CC numbers is PCI Compliant, then it doesn't matter who the maintainer is, really. If they cannot be seen after initial data entry you're pretty darned safe.

I absolutely agree with you that keeping CC and SSN information in ways where anyone can see that information post initial entry is just begging for a world of hurt.
 
britechguy said:
I am not trying to be snarky here, but how is keeping them in Quickbooks online not "keeping them yourself"?
Click to expand...
Because I'm not keeping them. Quickbooks Online is keeping them. They'll show me the last 4 digits and tell me it's a Visa. But that's all I know. And I can only apply it to her account. If the card number is lifted somehow it's not my fault. I don't know it.
 
@timeshifter

I guess my real question is who is the initial point of data entry and has ongoing access? That's who I think of as "keeping" something, as opposed to Quickbooks Online in this scenario, which is storing something.

I'm not trying to be difficult or nasty here, and you'll probably consider it semantic hair-splitting. But if I'm the originator of a database, regardless of the storage medium, and maintain it then I'm "keeping it" no matter how it's stored.
 
When it comes to online no one has access the underlying system(s). Just the data. I'd venture a guess that the customer is sent an initial invoice and they are prompted if the want to keep the card info stored. Select yes and it's Intuit's problem.
 
britechguy said:
I am not trying to be snarky here, but how is keeping them in Quickbooks online not "keeping them yourself"?

It does appear that they have an effective way of masking that data yet still making it accessible to you, but in the end you are the one who is maintaining the database.

Of course, if what Quickbooks Online does for CC numbers is PCI Compliant, then it doesn't matter who the maintainer is, really. If they cannot be seen after initial data entry you're pretty darned safe.

I absolutely agree with you that keeping CC and SSN information in ways where anyone can see that information post initial entry is just begging for a world of hurt.
Click to expand...
It boils down to who's website accepted the data. If you have QB Online do it, or Authorize.net or any other cloud service that specializes in this act, the owner of the CC details is using their systems to accept the data, and therefore you're utterly off the hook for securing it. You do not "own it", because you're not "keeping it". These are legal definitions.

Use of your own website via API or any other means to interact with even the above services is another level of pain to secure and maintain, and of course the ultimate level of pain is associated with self hosted solutions.

The cheapest option for us mere mortals is to just let the services that are good at such things do it, and get out of the way.
 
Exactly. I keep CC information on file for recurring billing using Square. I input the CC card data and save it in their system and I never can see it again except for the last 4 digits and the expiration date. If Square has a breach the issue is entirely on them legally.
 
You must log in or register to reply here.

Similar threads

johnrobert
Windows 10 home upgrade to pro got Enterprise instead
Replies
4
Views
1K
johnrobert
johnrobert
britechguy
Taking back your bandwidth from Microsoft . . .
Replies
2
Views
2K
Sky-Knight
Sky-Knight
HCHTech
IP Credit Card terminals connection issues
Replies
15
Views
2K
mikeroq
mikeroq
P
  • Locked
Hi! Windows XP boot-up problem after sp3 install and network drivers install
Replies
3
Views
2K
nlinecomputers
nlinecomputers
sapphirescales
PC Sales Down in "Post-PC" World
Replies
12
Views
2K
Ashton
Ashton
Back
Top