Encrypting Credit Card data in CRM

(0) Share

Report

Posted on by Karth

Folks,

There’s a requirement to encrypt credit card information stored on the Contact record in CRM. We plan to have custom fields to store this information. We are evaluating the option of using a Retrieve Plugin and .NET algorithms for Encryption and Decryption to achieve this. The other option is to store this information outside CRM and display this info through an IFRAME.

What are your thoughts around this design? Keen to know if you had a similar requirement and your design approach.

This will be for an on-premise CRM 2013 implementation.

Thanks,

Karth

*This post is locked for comments

I have the same question (0)

All responses (3)

Answers (0)

Rugved Gokhale on at

Like (0)

Report
Copy link

Link copied!

Hello Karth,

Nice scenario & question.

Not worked on such exact case earlier but frankly speaking as a part of opinion, I won't prefer to store credit card details inside CRM DB as apart from law factor (described by Guido, which is the most important factor), there are also many scenarios that u'll have to handle separately to restrict users like CRM administrator viewing the data as Admin being GOD user.

To have ultimate restriction (for unwanted users because this data "if displayed" has to be for restricted users only) to access such data, retrieve, retrieve multiple, displaying data through view on contact's related entity which has contact lookup (the way we can display quote number on quote details view), and many more possibilities could also arise. Handling each such case is manageable but would make it unnecessarily bulky thing.

Was this reply helpful? Yes No
Karth on at

Like (1)

Report
Copy link

Link copied!

That's a very good input, Guido. Need to research on the compliance stuff. Personally, I'm not a fan of storing sensitive data within CRM - it makes things very complicated and difficult to manage. Will keep you guys posted on what I find.

Thanks

Was this reply helpful? Yes No
PriteshOstwal 35 on at

Like (0)

Report
Copy link

Link copied!

Hi Karthik,

We have similar requirement though it is organization level credit card info so not as sensitive to be covered by PCI compliance. What was the result of your find on this?

Thanks in advance.

Pritesh Ostwal

Was this reply helpful? Yes No