I have a bit of a complicated scenario. I'll try to explain the problem, explain what I'm doing, and see if anyone else thinks this is feasible.
First off, we are PCI compliant. So, any solution I implement has to take compliance into consideration. Here is the scenario.
Our server is Server A. Server A is secure (https), PCI compliant, and hosts a web application. (Windows Server 2003, IIS 6)
Sever B is an external entity's web server. They have a website written in any flavor. This server is secure (https), but is not PCI compliant.
The client pulls down a page from Server B. There is a jquery plugin which hijacks the form on the page served by Server B. This causes the form to submit a jsonp http get request directly to server A. My assumption, correct or not, is that Server B never receives the post from the form even though the form is served to the client from Server B. This request contains sensitive (credit card) information in the query string. Again, assumption is that because the connection is https, this data is secure as part of the encrypted payload
So, Server A receives the request, and sends a response back to the client (accepted, declined, error, etc).
My questions are this: How can I be absolutely sure that Server A (my server) is not saving any of this data. I've already stripped off the query string from the logs, but is there anything else I need to turn off? Is the query string ever logged in the windows events? How about on the client machine? Is any of that data (the query string) going to be logged there? Also, how can I demonstrate (prove) to anyone (my boss) that the query string is part of the encrypted payload?
Clarification: Server A and Server B are not on the same domain. I have to make this http request work cross domain through an ajax call. I cannot use a proxy on server B.