According to the PCI-DSS standards, merchants and providers are permitted to store cardholder data once they become compliant. Some acquirers may permit sensitive authentication data” information security”  to be stored but only prior to payment authorization.