What card data you can store locally with Braintree and stay PCI compliant

TL;DR

Context: Stack Overflow #4495496 (accepted answer, 23 votes): A Rails developer using Braintree wanted to cache a returning customer's last 4 digits, card type, and cardholder name locally to avoid an API call on every page view, and asked whether storing those fields keeps them PCI compliant.

Steps

1. Storing the last 4 digits, the card type, and the cardholder name is fine under PCI. What you must never store is the full PAN, the CVV/CVC, or the magnetic stripe data. Braintree keeps the sensitive fields on its side, so caching just the display fields locally for your UI is compliant. When in doubt, check the PCI Quick Reference Guide, but last-four plus brand plus name is the standard safe set.

When to use

You are seeing this: Storing the last 4 digits, the card type, and the cardholder name is fine under PCI. Use this skill when you run into "What card data you can store locally with Braintree and stay PCI compliant".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #4495496 (accepted answer, 23 votes): A Rails developer using Braintree wanted to cache a returning customer's last 4 digits, card type, and cardholder name locally to avoid an API call on every page view, and asked whether storing those fields keeps them PCI compliant.

Verified resolution: Storing the last 4 digits, the card type, and the cardholder name is fine under PCI. What you must never store is the full PAN, the CVV/CVC, or the magnetic stripe data. Braintree keeps the sensitive fields on its side, so caching just the display fields locally for your UI is compliant. When in doubt, check the PCI Quick Reference Guide, but last-four plus brand plus name is the standard safe set.

Source URL: https://stackoverflow.com/questions/4495496