Skip to main content
CVV data is stored within the card token, subject to your CVV retention policy. This page covers how to manage the CVV data on an existing token.

​
How CVV Retention Works

PCI DSS prohibits permanent storage of CVV data. PCI Booking enforces this through configurable retention policies that automatically clear CVV after a defined period or usage count.
  1. Card is tokenized with CVV included.
  2. You have 60 minutes to set a per-token retention policy. If you don’t set one, the account-wide default applies - or, if no account-wide default exists, the system default (kept for one relay or one month, whichever comes first).
  3. CVV is retained and accessible for as long as the applicable policy allows - up to 4 years and up to 50 uses per destination if configured that way.
  4. Once the time limit is reached, or all uses across all destinations are consumed, CVV is deleted automatically. The card token itself is unaffected - only the CVV is cleared.
Full policy levels, per-destination quotas, and configuration steps are covered in CVV Retention Policy. Retention policies support two modes:
  • Time-based: CVV is cleared after a set duration (e.g., 60 minutes, 24 hours, 7 days)
  • Usage-based: CVV is cleared after a set number of detokenization uses per destination, allowing you to control exactly how many times the CVV can be sent to each PSP
You can combine both modes. For example, retain CVV for up to 7 days or 3 uses per destination, whichever comes first. This gives you flexibility to support multiple charge attempts while still enforcing strict limits.

​
Check CVV Status

Use the Retrieve Token Metadata endpoint to check whether CVV is currently stored on a token. The response includes the CvvExists flag and the EndRetentionDate indicating when the CVV is scheduled to be cleared. To see the full retention policy with per-destination quotas and usage counts, use the Get CVV Retention Policy endpoint. To check the policy for a specific destination, use Get Specific Policy.

​
Capture CVV Separately

When you already have a card token but need the CVV for a transaction, send a CVV-only capture form to the cardholder. This is useful when the original CVV has expired or been cleared, or when the card was tokenized without a CVV in the first place. See the CVV Capture Form guide for details.

​
Clear CVV Manually

Explicitly remove stored CVV from a token at any time using the Clear CVV endpoint, regardless of the retention policy. This is useful when you have completed all planned charges and want to proactively remove the CVV before the retention window expires. Once cleared, CVV cannot be recovered. You must capture it again from the cardholder.

​
Next Steps

CVV Capture Form

Capture CVV separately from the cardholder

CVV Retention Policy

Configure how long CVV is retained and under what conditions

Token Management Overview

All token management capabilities