I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the tenant?

  • 1
    Multi-tenant providers like WorldPay are PCI compliant so it must be possible.
    – paj28
    Jan 28, 2014 at 13:42

1 Answer 1


The PCI DSS standard does not directly prohibit shared tenant information, so the simplest answer is "yes, that's PCI compliant." The real answer is "...provided you have sufficient logical controls to prevent tenants from accessing information that isn't theirs." Do you have an application pen test which demonstrates the table-level identifier information is successfully used to partition access?

This is most closely spelled out in Appendix A "Additional PCI DSS Requirements for Shared Hosting Providers":

A.1 Protect each entity’s (that is merchant, service provider, or 
other entity) hosted environment and data

This is just making explicitly clear that the DSS restricts your ability to share PCI info. It's just as true if you have two tenants in a database as if you have two merchants in a shared hosting facility, but they didn't bother to spell out each shade of grey in detail.

In my experience, PCI cares that controls are in place. The only people who ask for complete separation from other tenants are... tenants. Usually big ones, who feel that you exist to provide an application for them. They would rather ask you to spin up separate infrastructure than trust your ability to create valid logical controls. It's like a knee-jerk thing with certain large companies.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .