---
title: Having a PCI Compliant Cardholder Data Environment (CDE)
description: Learn about Cardholder Data Environments and their role in helping users store credit card and debit card information.
image: https://blog.basistheory.com/hubfs/Cardholder%20Data%20Environments.png
---

[Skip to content](https://blog.basistheory.com/cardholder-data-environment-guide#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 August 28, 2025

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

# Having a PCI Compliant Cardholder Data Environment (CDE)

![](https://blog.basistheory.com/hubfs/Cardholder%20Data%20Environments.png)

## Table of Contents

- [What is a Cardholder Data Environment?](https://blog.basistheory.com/cardholder-data-environment-guide#Definition)
- [What can and cannot be stored in a CDE?](https://blog.basistheory.com/cardholder-data-environment-guide#Store)
- [Having a PCI Compliant CDE](https://blog.basistheory.com/cardholder-data-environment-guide#Compliance)
- [Should I buy or build a CDE?](https://blog.basistheory.com/cardholder-data-environment-guide#Decision)

New and emerging business models, requirements, and workflows are forcing companies to seek new ways to use sensitive payment data more effectively.

- “How can I safely send or receive plaintext cardholder data with a partner?”
- “How can I add a new processor to reduce transaction costs?”
- “How can I run my machine learning algorithms?”
- “How might I avoid living with the wrong vendor or implementation path?”

Answers to these questions inevitably come back to having a cardholder data environment ([CDE](https://www.techtarget.com/searchsecurity/definition/cardholder-data-environment-CDE)) that is flexible enough to provide access to cardholder data, and the existing gaps in some of today’s dominant implementation strategies.

From banks to customers, misuse of cardholder data leaves everyone vulnerable to significant reputational and financial harm. As such, PCI DSS mandates that the systems used to transmit and store credit card details—collectively known as your PCI CDE—meet the [12 requirements](https://blog.basistheory.com/12-pci-dss-requirements) and their over 300 sub-requirements, including a specialized cardholder data environment (CDE). 

Failure to properly store data can be expensive, costing businesses up to $100,000 each month for non-compliance. Aside from the fines, reputation loss, higher insurance costs, and even customer lawsuits typically follow suit.

## What is a Cardholder Data Environment? 

The Payment Card Industry Data Security Standard (PCI DSS, or PCI) uses the term Cardholder Data Environment (CDE) to refer to the collective network of servers, systems, people, and processes exposed to raw cardholder data or the data used to authenticate transactions, like [PIN, CVV, and CVC](https://blog.basistheory.com/credit-card-anatomy). The depth and breadth of your cardholder environment are often referred to as, “[scope](https://blog.basistheory.com/reduce-pci-scope).”  

Each item “in scope” must comply with every PCI requirement and be assessed annually, no matter how big or small the exposure. The more systems in scope, the bigger and costlier the effort to secure, monitor, and maintain its compliance. Conversely, the smaller the footprint, the simpler it is to attest compliance. 

A CDE consists of every system within an organization’s IT environment that has access to cardholder data, including those that manage authentication data for that environment. When developing a PCI DSS compliance strategy, one of the first and most important steps is identifying which systems make up the CDE. 

 Examples of systems commonly found within a CDE include the following:

- Servers: Companies commonly collect cardholder data via web-servers and store it in database servers.  Other servers may manage the authentication data used to grant or deny access to the CDE.  Both physical and virtualized servers are part of the CDE and within the scope of a compliance audit.
- Point of Sale (POS) Systems: POS systems are designed to read cardholder data from a payment card to process a transaction.  Payment terminals, cash registers, and similar systems are part of the CDE.
- Network Infrastructure: Cardholder data commonly travels over the network and may be inspected by various network and security solutions en route.  Firewalls, routers, wireless access points, and other network infrastructure may be considered part of the CDE.
- Applications: Servers host a variety of applications that perform the collection and processing of payment card data.  Applications are part of the CDE as well.
- Third-Party PCI Service Providers: To significantly reduce the burden of PCI, an organization may rely upon a third party’s CDE to collect, store, or process cardholder data through a process called [tokenization](https://blog.basistheory.com/tokenization-pci-compliance-faqs). Their CDE becomes your CDE. 

Maintaining scope can be easy at first, but over time CDEs can grow significantly as new needs arise. A centralized infrastructure and tokenization platform with supporting docs, preconfigured [SDKs](https://developers.basistheory.com/docs/sdks/), and access controls can help enforce compliant developer patterns, products, and services, as well as aid in evidence gathering for annual assessments. Invest in these tools to keep a small compliance footprint, reduce the costs of annual assessments, and streamline compliance approvals.

[Return to Top](https://blog.basistheory.com/cardholder-data-environment-guide#TOC)

## What can and cannot be stored in a CDE? 

PCI DSS breaks cardholder data into a couple of different categories, and some data can and cannot be stored within a CDE’s database.  

Companies are allowed to store the following types of cardholder data in a CDE:

- Primary Account Number ([PAN](https://blog.basistheory.com/doing-more-with-personal-account-numbers))
- Expiration Date
- Cardholder Name
- Service Code

While this information is useful for tracking accounts, it is not enough to perform payments unilaterally.  To do so, an organization may also need sensitive authentication data (SAD), which includes the following:

- Full data stored on the card’s magnetic strip.
- [CAV2/CVV2/CID](https://blog.basistheory.com/credit-card-anatomy)
- PIN

[SAD](https://www.nyu.edu/content/dam/nyu/compliance/documents/PCIDSSAppendix.pdf) is collected from a cardholder during payment and forwarded to the processor, but companies are prohibited from storing it, unlike cardholder data. This helps limit the risk of fraud since an attacker or malicious user lacks the information necessary to perform unauthorized transactions.

[Return to Top](https://blog.basistheory.com/cardholder-data-environment-guide#TOC)

## What does it take for a CDE to be PCI compliant? 

Break the effort down into three high-level buckets.

1. The implementation of a secure cardholder environment and programs (e.g., Setup and configuration of data protection controls.)
2. Maintaining your PCI environment and programs includes activities related to administering and enforcing the policies, controls, and required processes. 
3. The assessment [required](https://www.fa.ufl.edu/directives/self-assessment-questionnaire/) to validate or attest your compliance. These quarterly and annual exercises validate that the controls are in place for each item considered to be in PCI DSS compliance scope.

Some solutions allow organizations to leverage existing third-party service providers to provide up to 93% of the requirements and reduce the effort to do so by 99%. 

[Return to Top](https://blog.basistheory.com/cardholder-data-environment-guide#TOC)

## Should I build or buy a cardholder data environment? 

When it comes to setting up a CDE, you have two options: build or buy. Take a look at the next two blogs in the series to learn about each, their pros and cons, and helpful questions to ask as you evaluate your journey to PCI Compliance: 

1. Buy vs. Build: Service Provider CDE
2. Buy vs. Build: In-house CDE

By offloading your CDE to service providers, like Basis Theory, you can reduce your compliance effort by 99% and ensure continuous compliance with new PCI standards while retaining the same level of control needed to do things, like multi-party processing and split payments. 

Stand up a secure, fully compliant cardholder data environment with Basis Theory. Get started [with our documentation](https://developers.basistheory.com/docs/). 

[Return to Top](https://blog.basistheory.com/cardholder-data-environment-guide#TOC)

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKda0QWRoZCYsnxvyCrk5c%2B7QebWlduEA6yQ9rtf1K0l8JQn2Y%2B2k2ZZ4f0mXeMi22UWOIVSbhFMMJNoLU68FgSNgkPE46mUotkqD3lPJmkXj5BRoUCvjBLHXSHVJFw9rPmmxOlXZAzpJ7GFpALnnFM33aQjxrtzAbPFAaOZwh7H5td0YB6Nvd9Z9vG8lTCZQSn6%2FrhaqDxFuyXcD%2FU3ghuYOE%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![](https://blog.basistheory.com/hubfs/Card%20data.webp)](https://blog.basistheory.com/collect-store-card-data-securely)

[Data Tokenization](https://blog.basistheory.com/tag/data-tokenization)

### [How To Collect and Store Credit Card Data Securely](https://blog.basistheory.com/collect-store-card-data-securely)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 February 10, 2026

[Read more](https://blog.basistheory.com/collect-store-card-data-securely)

[![Blog header with article title ](https://blog.basistheory.com/hubfs/Storing%20credit%20cards%20buying%20vs.%20building-1.png)](https://blog.basistheory.com/buy-vs-build-storing-credit-cards)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [Storing Credit Cards: Outsource a Solution, or Build?](https://blog.basistheory.com/buy-vs-build-storing-credit-cards)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 January 24, 2023

[Read more](https://blog.basistheory.com/buy-vs-build-storing-credit-cards)

[![Credit Card Tokenization](https://blog.basistheory.com/hubfs/Credit%20Card%20Tokenization.webp)](https://blog.basistheory.com/credit-card-tokenization)

[Data Tokenization](https://blog.basistheory.com/tag/data-tokenization)

### [Credit Card Tokenization: Why it Matters, and When You Need a Vault](https://blog.basistheory.com/credit-card-tokenization)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 April 16, 2026

[Read more](https://blog.basistheory.com/credit-card-tokenization)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2026-02-06T19:39:21.567Z",
  "datePublished" : "2025-08-28T10:00:00.000Z",
  "headline" : "Having a PCI Compliant Cardholder Data Environment (CDE)",
  "image" : [ "https://blog.basistheory.com/hubfs/Cardholder%20Data%20Environments.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/cardholder-data-environment-guide",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```