Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the tenant?

share|improve this question
Multi-tenant providers like WorldPay are PCI compliant so it must be possible. – paj28 Jan 28 '14 at 13:42
up vote 2 down vote accepted

The PCI DSS standard does not directly prohibit shared tenant information, so the simplest answer is "yes, that's PCI compliant." The real answer is "...provided you have sufficient logical controls to prevent tenants from accessing information that isn't theirs." Do you have an application pen test which demonstrates the table-level identifier information is successfully used to partition access?

This is most closely spelled out in Appendix A "Additional PCI DSS Requirements for Shared Hosting Providers":

A.1 Protect each entity’s (that is merchant, service provider, or 
other entity) hosted environment and data

This is just making explicitly clear that the DSS restricts your ability to share PCI info. It's just as true if you have two tenants in a database as if you have two merchants in a shared hosting facility, but they didn't bother to spell out each shade of grey in detail.

In my experience, PCI cares that controls are in place. The only people who ask for complete separation from other tenants are... tenants. Usually big ones, who feel that you exist to provide an application for them. They would rather ask you to spin up separate infrastructure than trust your ability to create valid logical controls. It's like a knee-jerk thing with certain large companies.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.