CVV Retention Policy

PCI DSS prohibits long-term storage of CVV data. When a card is tokenized with CVV, you need a retention policy that defines how long the CVV is kept and how many times it can be used before it is automatically cleared.

​

How It Works

CVV retention is not part of the tokenization request itself. It is a separate step that happens after tokenization:

1. Card is tokenized (via any tokenization method) with CVV included.
2. You have 60 minutes to set a per-token CVV retention policy via the Set CVV Retention Policy endpoint.
3. If you don’t set one, the account-wide default policy is applied automatically. If no account-wide default exists, the system default applies: CVV can be used once and is then cleared.

This applies to every tokenization method that captures CVV.

​

Policy Levels

​

Policy Types

​

Destination Types

Per-destination policies support these destination types:

​

Auto-Delete Card on CVV Expiry

You can optionally configure the policy to delete the entire card token when its CVV is cleared, using the DeleteCardUponCvvCleanup option. Use this when a token without CVV has no value in your workflow.

​

Setting the Account-Wide Default

To set a default CVV retention policy that applies automatically to all new tokens in your account:

1. Log in to the PCI Booking portal.
2. Navigate to Booker Settings > CVV Store Rules.
3. Under Storage Period, set the duration that CVV is stored (e.g., 12 months). Maximum is 4 years / 48 months.
4. Under Destinations, define the approved list of destinations where CVV can be relayed. For each destination, specify:
   • Destination type (see Destination Types above)
   • Destination value (e.g., hostname, IP address)
   • Quota (number of times the CVV can be relayed to this destination)

Per-token policies set via the API override the account-wide default for that specific token.

​

Managing Per-Token Policies

​

Next Steps