Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it safe to store credit card information in a database on a VPS? Or is it best to put it on an absolutely under-utilized dedicated server?

share|improve this question
PCI compliance will come into question at some point. In short, a dedicated server would probably be best but won't address all issues. Kyle hit the nail on the head. – Warner Apr 12 '10 at 13:08
As others have said, you definitely need to read up on PCI compliance. Generally speaking, unless you are prepared to invest a lot of money in doing it right, you are unlikely to want to store any credit card information even in-house, let alone on a VPS. – Skyhawk Apr 12 '10 at 15:44
up vote 7 down vote accepted

Use a reputable third-party payment gateway -- they'll store the credit cards for you, so if you need to initiate another transaction (like a refund or a subscription renewal) you can request it through their secure API.

Often times (for display purposes or binding clients to credit card numbers) the last 4 digits will suffice.

share|improve this answer

Unless you are a big shop, I would say no, not safe and not a good idea. You will spend much more money getting PCI compliant and securing the box than you would paying for a payment gateway to deal with this for you.

share|improve this answer
+1: If you don't know, then you need to be using a third party, and storing next to nothing locally. – Satanicpuppy Apr 12 '10 at 14:23

Just same info on PCI compliance. It takes about 1 year to be compliant, with most of the time taken up by paperwork and documentation. Probably it is not worth it.

And you have to pay top dollars for security consultants that certify you are compliant, of course.

It is a good exercise to read the PCI documentation anyway, since it is basically a collection of good practices.

share|improve this answer
PCI is most definately NOT just papwerwork and documentaion. – Zypher Apr 12 '10 at 15:56
@Zephyr: you are right, but most of the time to get compliant will be taken up with those two tasks. – Dan Andreatta Apr 12 '10 at 16:06

If this isn't your datacenter, ask the provider if they are PCI compliant, and if that applies to their VPS as well as dedicated hosting solutions.

share|improve this answer
PCI compliance is more that just encrypting data. Keeping CC data on a server you do not fully control, it probably means that the hosting company has to be compliant too... – Dan Andreatta Apr 12 '10 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.