---
title: "SAD/CVC Data Retention: Why Deletion Must Include Backups"
description: Most platforms purge SAD/CVC from primary storage but not backups. Basis Theory closes this data retention gap!
image: https://blog.basistheory.com/hubfs/Storing%20Deleting%20Sensitive%20Data.webp
---

[Skip to content](https://blog.basistheory.com/data-retention-cvc-sad#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 October 8, 2026

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[Data Tokenization](https://blog.basistheory.com/tag/data-tokenization) [Compliance](https://blog.basistheory.com/tag/compliance)

# SAD/CVC Data Retention: Why Deletion Must Include Backups

![SAD/CVC Data Retention](https://blog.basistheory.com/hubfs/Storing%20Deleting%20Sensitive%20Data.webp)

## Table of Contents

- [Backup and Recovery Are Table Stakes](https://blog.basistheory.com/data-retention-cvc-sad#Stakes)
- [Resilience is Not Just What You Build](https://blog.basistheory.com/data-retention-cvc-sad#Build)
- [The Question Worth Asking About Data Retention](https://blog.basistheory.com/data-retention-cvc-sad#Data)

There’s more than one way to accomplish a goal.

Money can move from [point A to point B](https://blog.basistheory.com/smart-payment-routing) using different payment rails or methods; postage can be delivered by UPS, FedEx, or the United States Postal Service; and security systems can be designed in different ways to keep Sensitive Authentication Data (SAD) and Card Verification Codes (CVC) from landing somewhere they shouldn’t. But just because there’s different ways to store and delete sensitive data doesn’t mean picking the right one for the business it serves isn’t critical to long-term success.

The difference between the two data retention strategies shapes what a team has to build and maintain. One approach encrypts SAD in the browser before it reaches the server, giving the customer ownership of the resulting ciphertext. The data never arrives at the vault in plaintext, but the ciphertext has to live somewhere—and Payment Card Industry Data Security Standard (PCI DSS) treats an encrypted CVC the same way it treats one in plaintext if the customer holds the keys and controls where it’s stored.

That means it’s in [scope](https://blog.basistheory.com/pci-dss-scope).

The other approach, the one we built, removes SAD from the backup and snapshot pipeline entirely at the platform level. There is no customer-owned ciphertext to manage, because there’s no persistent copy to manage in the first place, whether it’s encrypted or not. The critical element to this solution is that SAD is purged from logs when it is deleted from the system, eliminating the risk of its being uncovered while in storage.

The trade-off is architectural and requires us to rebuild how backups handle certain data classes so that no individual customer has to build anything to get the same guarantee.

Neither approach is wrong. The choices reflect different bets about the responsibility sitting with the platform, or with the team integrating it. After authorization, ask yourself: whose infrastructure is SAD sitting in? And who’s accountable for making sure it doesn’t persist somewhere it shouldn’t?

## Backup and Recovery Are Table Stakes

It’s easy for a processor to describe its backup and disaster recovery posture. There’s point-in-time recovery, tested restore procedures, and documented failover.

That’s table stakes and expected. If a platform can’t recover your data after an incident, nothing else matters. Basis Theory does this too, with backups running on schedule, and restore points tested annually.

The distinction that matters is not just backing up data, it’s also making sure that deleted data doesn’t persist in the backup. Resilience means full recoverability where you want it, and no persistence where you don’t.

That's a harder property to build than either backup or deletion alone, and it's not something you can verify by reading a vendor's marketing page. It's something you find out by asking, the way that one compliance reviewer did: does this apply to every place a copy could exist, or just the one you were told to check?

[Return to Top](https://blog.basistheory.com/data-retention-cvc-sad#TOC)

## Resilience is Not Just What You Build

The SAD/CVC fix started because a customer's compliance reviewer found a gap and told us about it. What happened next is arguably the most important part of the story: we treated that as a platform-wide problem the moment we understood it, not a one-off patch for the account that raised it. That's the part of resilience that doesn't show up in an architecture diagram.

Systems fail, gaps get found, and vulnerabilities surface in ways no design review catches in advance. What separates a resilient platform isn’t an absence of outages; it’s the process that closes the gap once something does happen, and ensures the fix reaches every customer, not just the one who asked.

We hold our own teams to the same standard we're describing here for data.

Nothing is treated as done until it's true everywhere, not just where someone looked. That standard applies to how we build software, how fast a fix ships once a problem is confirmed, and how directly we tell customers when something changes.

[Return to Top](https://blog.basistheory.com/data-retention-cvc-sad#TOC)

## The Question Worth Asking About Data Retention

Data retention looks straightforward until someone checks every place a copy could exist. That's the gap this post started with. A policy that was explicit for primary storage and silent on backups only surfaces when someone asks one more question than the documentation answers. The fix wasn't a workaround for one account. It changed how backups handle SAD and CVC across the platform, so the answer holds regardless of which customer or which system asks.

That's what we mean when we say resilience isn't just architecture. It's whether a gap, once found, gets closed everywhere or just where it was found.

Reading a data retention policy tells you what's supposed to happen to sensitive data. It doesn't tell you what's excluded from backups, how that's tested, or whether the answer is the same for every customer on the platform. That's the question worth asking any vendor handling SAD or CVC on your behalf.

Basis Theory's backup and recovery testing, along with our data retention approach for SAD/CVC, are documented in our Trust Center. If you're running this same check on your own systems, or on a vendor's, this is the artifact to ask for.

[Return to Top](https://blog.basistheory.com/data-retention-cvc-sad#TOC)

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKIBpRj%2BjT8%2FMZq9uhy2PZlCfcWa2PSs7O%2FP4v86WP%2FUoX3iJqE04UAFwsdkp41Qal%2FMzjsz7MAgAElt%2BPMWqlICH0czAXoB17gGhom6adIsU5hRlC%2FNuK4rpq5CWqC1nKB%2FGymyDdVwIJzIK7rQKg5iOOWvUGD3HtAEWNFuavxp%2FopoEEpXdxWrGUvmS1RnxPwSR3G42NjMIjDROEc0MTqdZIWe37EvL%2FBLPGZmaoAvpIrScVrBw%3D%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![BIN Details](https://blog.basistheory.com/hubfs/Updated%20BIN%20Details.webp)](https://blog.basistheory.com/bin-details-delivered-faster)

[Engineering](https://blog.basistheory.com/tag/engineering)

### [BIN Details Delivered 3X Faster](https://blog.basistheory.com/bin-details-delivered-faster)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 June 9, 2026

[Read more](https://blog.basistheory.com/bin-details-delivered-faster)

[![http service: dual writing for ultimate flexibility](https://blog.basistheory.com/hubfs/http-service-dual-writing.png)](https://blog.basistheory.com/http-service-multi-vaulting)

[Product](https://blog.basistheory.com/tag/product)

### [HTTP Service: Dual Write Data for Ultimate Flexibility](https://blog.basistheory.com/http-service-multi-vaulting)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 July 27, 2023

[Read more](https://blog.basistheory.com/http-service-multi-vaulting)

[![](https://blog.basistheory.com/hubfs/Stale%20Card%20Data%20B.webp)](https://blog.basistheory.com/stale-card-data)

[Payments](https://blog.basistheory.com/tag/payments)

### [Stale Card Data: A Hidden Tax on Subscription Revenue](https://blog.basistheory.com/stale-card-data)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 February 5, 2026

[Read more](https://blog.basistheory.com/stale-card-data)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2026-10-08T13:13:34.901Z",
  "datePublished" : "2026-10-08T13:10:21.000Z",
  "headline" : "SAD/CVC Data Retention: Why Deletion Must Include Backups",
  "image" : [ "https://blog.basistheory.com/hubfs/Storing%20Deleting%20Sensitive%20Data.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/data-retention-cvc-sad",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```