Does storing CC data in the session violate PCI compliance?
jawspeak: I've heard of companies having an internal policy: if in memory (in their data center's control) PCI sensitive data was allowed.In some cases (memory mapped files) it could persist to disk, so either encryption, or a Compensating Control Document was created (limiting access to the filesystem).