Guide
PCI DSS CVV storage: why the answer is almost always no
The PCI DSS CVV storage rule is simple: card security codes must not be stored after authorisation, even if encrypted. So any place that keeps them, from a database to a notepad, is a serious finding.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What PCI DSS CVV storage rules say
Security codes belong to sensitive authentication data, along with full track data and PIN blocks. Requirement 3.3.1 says this data must not be retained after authorisation. The standard is in the PCI SSC document library.
| Data | Store after authorisation? |
|---|---|
| Card number (PAN) | Only if needed, and protected. |
| Expiry date and name | Allowed with protection. |
| Security code (CVV/CVC) | No. |
| Full track data | No. |
| PIN or PIN block | No. |
PCI DSS CVV storage before authorisation
Data may be held briefly while a transaction is being authorised. However, version 4.0.1 requires it to be encrypted with strong cryptography during that time. So any temporary storage needs careful design.
PCI DSS CVV storage check
Tick each statement that is true. All should be true.
Your result appears here as you tick, so you can see what is still open.
Where PCI DSS CVV storage mistakes happen
Codes often end up where nobody expects them. Therefore search widely, not just the payment database.
- Order notes and customer service tickets
- Email inboxes and spreadsheets
- Call recordings with codes read aloud
- Application logs and debugging output
Each of these counts as storage. As a result, a search exercise across tools is often the most valuable first step.
Recurring payments without PCI DSS CVV storage
Recurring billing does not need the security code after the first payment. Instead, payment providers use tokens, so you never need to keep the code at all.
Our role
We help find and remove stored codes, then change processes so they stop arriving. However, we are not a QSA, so validation remains with you or your assessor.
Also check third-party tools that touch orders. For example, a support desk plugin may copy order notes, including codes, into its own storage.
PCI DSS CVV storage questions
Does encryption allow PCI DSS CVV storage?
No. Encryption does not make storage after authorisation acceptable.
Do PCI DSS CVV storage rules apply to paper?
Yes. Written codes are stored data too.
How do card-on-file payments avoid PCI DSS CVV storage?
Use provider tokens, so the code is never needed again.
Is any business exempt?
Card issuers have narrow exceptions, but merchants do not.
Related guides
Find and remove stored security codes
Tell us where card data enters your business. We reply with a written estimate for a data discovery and clean-up.
Get my written estimate