However, Merchants may wish to store this data for their records, or they may require the data to be kept on file to use to process subsequent recurring transactions, or to avoid the customer having to re-enter the data. If the data persists on the application server, it must be secured as well. Files containing it should have restricted operating system permissions to disallow general users from seeing it. The same applies if it is in a database rather than a flat file. If the database is remote rather than local, the network between the two should either be private, or have some security layer running on it.
Some databases support storing fields encrypted as well.
The same data is going to appear on backups, so they need to be kept in areas with only authorized access as well. Generally private networks are used exclusively between the gateway and the issuing bank networks.