title: Security considerations when collecting and storing bank account details in a php/mysql application
body: <p>We have been asked to look into the feasibility of an application to collect bank account numbers and sort codes and store them temporarily for offline processing through a paperless direct debit system.</p>
  
  <p>Data will be collected from website visitors through a 256 bit SSL connection and stored in a mySQL database for later collection by our client.  This data would be held temporarily until downloaded at which point it would be erased from the database.</p>
  
  <p>Details:
  We host a few other websites on this particular server
  No-one has shell access or FTP access to the server
  Server is PCI compliant
  Mod_security and other software running on machine</p>
  
  <p>I know this is very similar to this question <a href="https://stackoverflow.com/questions/596706/best-practices-for-storing-bank-information-in-a-database">Best practices for storing bank information in a database</a>, and appreciate the bulk of responses are to steer clear.</p>
  
  <p>I understand the list of security considerations is potentially very large.</p>
  
  <p>What particular areas of security should we focus on?</p>