The relevant PCI-DSS section says: 3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: * One-way hashes based on strong cryptography (hash must be of the entire PAN) * Truncation (hashing cannot be used to replace the truncated segment of PAN) * Index tokens and pads (pads must be securely stored) * Strong cryptography with associated key-management processes and procedures https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf The *anywhere it is stored* part seems pretty clear - there's no exception for storing unencrypted PAN data in a RAM based database. You said your architecture was deemed compliant - If you had a QSA evaluate your environment, this would be a good question to ask him.