Storing the PAN is not a "PCI violation". It's not best practice, for sure, and you then have an obligation to secure your systems much more thoroughly, but you

Storing the PAN is not a "PCI violation". It's not best practice, for sure, and you then have an obligation to secure your systems much more thoroughly, but you can do it. "Payment brand rules allow for the storage of primary account number (PAN), expiration date, cardholder name, and service code." https://www.pcisecuritystandards.org/documents/SAQ_InstrGuidelines_v3-1.pdf https://www.pcisecuritystandards.org/documents/SAQ_InstrGuid... (There are other types of data you can NEVER store (also described in the above document) like the CVV or PIN code, which is perhaps what you meant.)