2

I have a payment processing client that runs exclusively on the desktop. The operator enters payment data and clicks a button and my app sends the data off to a payment gateway via a secure channel. My app never stores sensitive payment data, although it does encrypts and saves the merchant's gateway login info.

Am I in scope? If I am, why are web browsers out of scope when the perform the exact same function in the same way?

ATL_DEV
  • 9,256
  • 11
  • 60
  • 102

2 Answers2

3

If the operator keys in a credit card card number then yes; your software both accepts & transmits cardholder data so it, the machine running it & any network(s) its attached to are all in scope of PCI and so must be compliant.

Q: To whom does PCI apply?
A: PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply

Browsers are not in scope only when the person using one to enter card details is the owner of the card & not a 3rd party merchant. PCI only applies to merchants & other processing entities, not the customers of the issuing card schemes.

Alex K.
  • 171,639
  • 30
  • 264
  • 288
  • So what about the case where the operator places an order on behalf of the customer using a web browser? Many customers use their eCommerce system for phone orders. – ATL_DEV Dec 15 '11 at 18:25
  • As I see it the operator is employed by a merchant, the merchant has PCI obligations to the card issuers & since the operator is accepting card data it all falls under PCI scope. Take look @ http://security.stackexchange.com/questions/2922/why-doesnt-the-clients-web-browser-need-to-be-pci-compliant – Alex K. Dec 15 '11 at 18:34
  • I'm still left scratching my head here. I think I should have asked wether my application is in scope for PA-DSS certification. I've been told by certifiers that I do, but the more I think about it, I don't. – ATL_DEV Dec 16 '11 at 02:38
0

Your app handles card numbers and is involved in the authorisation and/or settlement of card transactions. If you are providing it as off the shelf software it is in scope for PA-DSS.

The organisation that installs your app and runs it in their environment is in scope for PCI-DSS.

dfbpdave
  • 348
  • 1
  • 4