PCI DSS compliance for storing PAN and PII in multi-tenant environment

Question

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the tenant?

Answer 1

The PCI DSS standard does not directly prohibit shared tenant information, so the simplest answer is "yes, that's PCI compliant." The real answer is "...provided you have sufficient logical controls to prevent tenants from accessing information that isn't theirs." Do you have an application pen test which demonstrates the table-level identifier information is successfully used to partition access?

This is most closely spelled out in Appendix A "Additional PCI DSS Requirements for Shared Hosting Providers":

A.1 Protect each entity’s (that is merchant, service provider, or 
other entity) hosted environment and data

This is just making explicitly clear that the DSS restricts your ability to share PCI info. It's just as true if you have two tenants in a database as if you have two merchants in a shared hosting facility, but they didn't bother to spell out each shade of grey in detail.

In my experience, PCI cares that controls are in place. The only people who ask for complete separation from other tenants are... tenants. Usually big ones, who feel that you exist to provide an application for them. They would rather ask you to spin up separate infrastructure than trust your ability to create valid logical controls. It's like a knee-jerk thing with certain large companies.