A merchant cannot store full card details — that requires your own PCI DSS certification, and its requirements are out of proportion for an ordinary online store. Details are entered on the certified provider side, and repeat charges use a token.
What must not be stored
- The full card number, expiry date and cardholder name together.
- The CVC/CVV code — it may not be stored at all, even encrypted.
- Magnetic stripe or chip data, and authentication values.
What may be stored
- The token — an anonymised reference to the card used for repeat charges.
- The last four digits and the card scheme — for your interface and support.
- The operation id and status — for reconciliation and refunds.
Why this is better for you
- A leaked token gives an attacker no means of payment: it is useless outside your store.
- Certification and audits stay with the provider rather than your team.
- The customer does not re-enter the card — subscriptions and repeat purchases keep working.
How tokenisation works is covered separately.
