---
title: "How To Collect and Store Credit Card Data Securely: Ultimate Guide"
description: Merchants must always collect and store credit card data securely to protect their customers. Here’s how.
image: https://blog.basistheory.com/hubfs/Card%20data.webp
---

[Skip to content](https://blog.basistheory.com/collect-store-card-data-securely#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 February 10, 2026

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[Data Tokenization](https://blog.basistheory.com/tag/data-tokenization) [Payments](https://blog.basistheory.com/tag/payments)

# How To Collect and Store Credit Card Data Securely

![](https://blog.basistheory.com/hubfs/Card%20data.webp)

## Table of Contents

- [Should Cardholder Data Be Stored?](https://blog.basistheory.com/collect-store-card-data-securely#should-be-stored)
- [Can Cardholder Data Be Stored Securely?](https://blog.basistheory.com/collect-store-card-data-securely#chd-stored-securely)
- [What Does PCI Scope Mean?](https://blog.basistheory.com/collect-store-card-data-securely#pci-scope)
- [How to Store Credit Card Data Securely: Options](https://blog.basistheory.com/collect-store-card-data-securely#options)
- [What Can and Cannot be Stored in a CDE?](https://blog.basistheory.com/collect-store-card-data-securely#cannot-store)

When merchants accept credit card payments, they also must consider what happens after the transaction is authorized. Can they store the card data? Should they? 

Knowing that maintaining PCI compliance is the ever-present overlay to payments, merchants should be rightfully hesitant to use cardholder data past the point of transaction. That is, unless they store the data securely and compliantly.

## Should Cardholder Data Be Stored?

In many cases, yes. 

The decision on whether to store cardholder data can be dependent on a merchant’s business need, such as the ability to route or split incoming payments, and on the company’s appetite for risk. 

Often, merchants want to store cardholder data, whether in-house through an internal [Cardholder Data Environment (CDE)](https://blog.basistheory.com/cardholder-data-environment-guide) or externally with a partner that hosts a CDE on the merchant’s behalf.

A CDE consists of every system within an organization’s IT environment that has access to cardholder data, including those that manage authentication data for that environment. 

Examples of systems commonly found within a CDE include the following:

- Servers
- Point of Sale (POS) Systems
- Network infrastructure
- Applications

These CDEs have specific, detailed requirements they must meet to store credit card data securely. The Payment Card Industry Data Security Standard (PCI DSS) mandates that the systems that transmit and store credit card details meet the [12 requirements](https://blog.basistheory.com/12-pci-dss-requirements) and their over 300 sub-requirements, including a specialized CDE.

[Return to Top](https://blog.basistheory.com/collect-store-card-data-securely#TOC)

## Can Cardholder Data Be Stored Securely?

Yes, absolutely. 

Cardholder data must always be stored securely, in compliance with strict PCI DSS 4.0 requirements and industry standards, because it is “[in-scope](https://blog.basistheory.com/pci-dss-scope)” for PCI DSS 4.0.

Failure to properly store data can be expensive, costing businesses up to $100,000 monthly for non-compliance. Aside from the fines, reputation loss, higher insurance costs, and even customer lawsuits typically follow suit.

[Return to Top](https://blog.basistheory.com/collect-store-card-data-securely#TOC)

## What Does PCI Scope Mean? What’s In Scope?

The choice of in- or out-of-scope regarding PCI DSS compliance is not binary. 

There are, in fact, three designations for systems:

- In-scope: Any system with direct access to collect, store, or transmit cardholder data. Any element of your payment structure that, at any time, has access to PII in plain text is unequivocally in-scope and is known as being in the [Cardholder Data Environment (CDE)](https://blog.basistheory.com/cardholder-data-environment-guide).
- Connected-to: Any system that connects to the CDE without being directly involved in credit card details or processing transactions.
- Out-of-scope: Any system that has no access to the CDE.

Note that each business is also responsible for the scope and compliance of its partners: for instance, storing PII on a cloud server would require the merchant to ensure that the cloud provider, and that the interfaces between provider and merchant, were fully PCI compliant.

[Return to Top](https://blog.basistheory.com/collect-store-card-data-securely#TOC)

## Options for Storing Credit Card Data

Generally speaking, merchants have two options for securely storing credit card data: through a third-party service provider or in-house.

### Third-Party Service Providers

Third-party service providers can help with the implementation, maintenance, and attestation required to maintain a compliant CDE.

Today, there are three types of Service Providers:

- Payments Service Providers (PSPs) bundle a core offering with payment processing services, allowing merchants to quickly and easily accept payments.
- Card issuing platforms use their core offering and card issuers (i.e., banks) to generate cards for their customers' end users.
- Tokenization platforms provide a core infrastructure without card processing or issuing services.

### In-House CDE Solution

Hosting your compliant CDE can provide efficiencies in terms of costs, system transparency, and integrations that some service providers, especially payment and card-issuing providers, cannot. 

Setting up a cardholder data environment to store credit cards isn’t rocket science. Still, getting something valuable and compliant requires significant knob-turning, socializing, documentation, decisions, and configuration. 

This includes, but is not limited to: 

- Identifying and implementing solutions and vendors.
- Segmenting and setting up infrastructure and firewalls.
- Developing and administering training and policies, and more.

[Return to Top](https://blog.basistheory.com/collect-store-card-data-securely#TOC)

## What Can and Cannot be Stored in a CDE?

PCI DSS breaks cardholder data into a few different categories, and some data can and cannot be stored within a CDE’s database.  

Companies are allowed to store the following types of cardholder data in a CDE:

- Primary Account Number (PAN)
- Expiration Date
- Cardholder Name
- Service Code

While this information is useful for tracking accounts, it is not enough to perform payments unilaterally. To do so, an organization may also need sensitive authentication data (SAD), which includes the following:

- Full data stored on the card’s magnetic strip.
- CAV2/CVV2/CID
- PIN

SAD is collected from a cardholder during payment and forwarded to the processor, but companies are prohibited from storing it, unlike cardholder data. This helps limit the risk of fraud, as an attacker or malicious user lacks the information needed to perform unauthorized transactions.

All organizations have two options for building a cardholder data environment for secure data storage: build a solution in-house or buy.

Selecting the right option is important, but it requires significant research, planning, and organization. 

As a [PCI Level 1](https://blog.basistheory.com/pci-compliance-levels)-compliant service provider, Basis Theory provides an independently assessed and approved CDE (Secure Token Vault) to customers. Combined with a suite of configurable tools, services, and tokens, merchants can collect, secure, and share credit cards without bringing their systems into scope.

This approach allows companies to avoid the costs and distractions associated with many of the PCI requirements while retaining complete control over their cardholder data.

[Return to Top](https://blog.basistheory.com/collect-store-card-data-securely#TOC)

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIckxBhCzQ7MkhIxmBauAq57RnTLv1QWc%2BVOj7oG19l48%2F5Mdsg%2FXdtle9Ev3Lm7ohJJthPqNAzq9sX5ntZFq3%2FRi7Ue%2FkQ%2B7jIfY1JzDAM2vQItw%2F74ZbVaiiqQHpZZDQvSw%2F2AJWNuiC%2Br6yFMJN0YWcdNjlc11VdPmNgFoUBHJskm3M8q7MQnIeZjdFVpTl%2B9G%2Ff8576v0fOjzDu8QLtlSHhO7f9KWU6uP3%2F2mJeYBK7Pha1aQ%3D%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![](https://blog.basistheory.com/hubfs/Cardholder%20Data%20Environments.png)](https://blog.basistheory.com/cardholder-data-environment-guide)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [Having a PCI Compliant Cardholder Data Environment (CDE)](https://blog.basistheory.com/cardholder-data-environment-guide)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 August 28, 2025

[Read more](https://blog.basistheory.com/cardholder-data-environment-guide)

[![What's in PCI scope?](https://blog.basistheory.com/hubfs/PCI%20DSS.webp)](https://blog.basistheory.com/pci-dss-scope)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [What’s in PCI scope vs. out of scope?](https://blog.basistheory.com/pci-dss-scope)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 January 22, 2026

[Read more](https://blog.basistheory.com/pci-dss-scope)

[![Does Your Chatbot Put You in PCI Scope?](https://blog.basistheory.com/hubfs/ChatbotPCIScope.webp)](https://blog.basistheory.com/does-your-chatbot-put-you-in-pci-scope)

[Data Tokenization](https://blog.basistheory.com/tag/data-tokenization)

### [Does Your Chatbot Put You in PCI Scope? Here's How to Fix It](https://blog.basistheory.com/does-your-chatbot-put-you-in-pci-scope)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 August 6, 2026

[Read more](https://blog.basistheory.com/does-your-chatbot-put-you-in-pci-scope)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2026-02-10T13:44:38.392Z",
  "datePublished" : "2026-02-10T13:44:27.000Z",
  "headline" : "How To Collect and Store Credit Card Data Securely: Ultimate Guide",
  "image" : [ "https://blog.basistheory.com/hubfs/Card%20data.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/collect-store-card-data-securely",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```