{"head":{"title":"What Is a Cardholder Data Environment (CDE)? | OceanLab","description":"The cardholder data environment is every system and person that stores, processes or sends card data, plus what connects to it. Why it sets PCI scope.","canonical":"https://oceanlab.in/glossary/cardholder-data-environment"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"cardholder data environment","path":"/glossary/cardholder-data-environment"}],"slug":"cardholder-data-environment","term":"Cardholder data environment (CDE)","aka":["CDE"],"category":"Compliance","short":"The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.","body":[["PCI DSS, the security standard for payment card data, uses the CDE to mark what is in scope. Card numbers and sensitive authentication data define the core. Any system that can reach those systems, such as a shared network, an admin laptop or a logging server, is pulled into scope too unless it is properly segmented."],["The PCI Security Standards Council publishes the standard, its glossary and the self-assessment questionnaires (SAQs) that smaller merchants use to report compliance."]],"why":["The size of your CDE drives most of the PCI DSS work. Keeping card data out of your own systems, for example with a hosted payment page, an iframe from the payment provider or tokenization, shrinks the CDE and can move you to a much shorter SAQ. That is a design decision best made before the build, not after."],"example":["An online store first built its own card form that posted to its servers, which put its web servers and database in the CDE. Switching to the payment provider's hosted fields means card numbers never reach the store's servers, so far fewer of its systems are in scope."],"inBuild":null,"mistakes":[["Logging full card numbers by accident in error logs or analytics events."],["Forgetting connected systems. Anything that can reach the CDE can be in scope."],["Assuming a PCI-compliant payment provider makes your whole app compliant. Your part still has requirements."]],"related":[{"href":"/glossary/maker-checker","label":"Maker-checker (four-eyes principle)","detail":"A control where one person makes a change and a different person must approve it before it takes effect."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."},{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."},{"href":"/glossary/guardrails","label":"Guardrails (AI)","detail":"Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs."}],"tools":[{"href":"/tools/pci-dss-saq-picker","label":"PCI DSS SAQ picker","detail":"Free tool"},{"href":"/tools/payment-processing-fee-calculator","label":"Payment processing fee calculator","detail":"Free tool"}],"links":[{"href":"/compliance/pci-dss","label":"PCI DSS guide","detail":"Card data rules and how to shrink your scope."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."}],"sources":[{"title":"PCI Security Standards Council glossary","url":"https://www.pcisecuritystandards.org/glossary/","checkedAt":"2026-10-25"},{"title":"PCI SSC document library (PCI DSS and SAQs)","url":"https://www.pcisecuritystandards.org/document_library/","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}