I have been doing some research and I found out that it's a really really bad idea to store users' sensitive information in a database.
Here's what I am trying to do.
1. Request a member's bank account info.
2. Make a direct deposit into their bank account from my bank account. This is done online through my bank's website.
My question is, if I can't store the member's bank account info in the database, can I at least request them to send it through an email? From there I can put it in excel sheet offline for storage and use that to make direct bank deposits to their account(s). Or is that illegal? If it is, then what's the best way to do this?