Cardholder data is stored only in isolated, documented environment

PCI-DSS 4.0 Req 3.2 and 3.4 prohibit storing raw cardholder data outside an isolated, documented Cardholder Data Environment (CDE). A general-purpose database containing card numbers or CVVs is fully in scope for a Level 1 PCI audit — expanding your compliance surface and dramatically raising breach risk. Under OWASP A02 (Cryptographic Failures), exposed card numbers in an unprotected schema are trivially dumped via SQL injection or misconfigured backups. CWE-312 (Cleartext Storage) applies when tokenization is skipped. Req 12.4 requires that scope documentation exists; without it you cannot demonstrate compliance at all.

Delegate all card handling to a PCI-Level 1 processor (Stripe, Square) and verify your application never receives or stores raw PANs. If you must retain partial data (last-4, expiry month/year — never CVV per Req 3.3), isolate it in a separate database with Row-Level Security enabled and document the CDE boundary in docs/cde-architecture.md. Reference that file in your SAQ.

-- Separate CDE schema, row-level isolation
ALTER TABLE cardholder_data ENABLE ROW LEVEL SECURITY;
CREATE POLICY cde_merchant_isolation ON cardholder_data
  FOR ALL USING (merchant_id = auth.uid());