Cardholder Data vs Sensitive Authentication Data: What You May Store

Cardholder data themes

PAN, cardholder name, expiration, and service code when present with PAN — protect per DSS if stored.

Sensitive authentication data

Full track data, CAV2/CVC2/CVV2/CID, PINs/PIN blocks — must not be stored after authorisation.

Engineering controls

• Log redaction and truncation
• Form fields that never POST CVV to your app tier
• Tokenisation to remove PAN from apps

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Can we store truncated PAN?

Truncation/hashing rules apply — follow DSS display and storage requirements.

CVV in support tools?

Forbidden after auth — scrub CRM and call recordings.

Token vaults?

Tokens reduce CHD in apps but vaults remain in scope.

Related Resources

• P2PE/Tokenization
• PCI hub