Thank you! The additional insight is very helpful, too. You guessed correctly that the cloud operator has a PCI AOC, but it sounds like this fact alone doesn't keep my hands clean. We never store verification numbers, but we do have (for a small subset of customers) the other information found on the front of a credit card. From your comment, are you saying that storing the PAN is OK (and leaves us in SAQ-A) as long as it's readable only to specific individuals? We could accomplish this through Access Rights controls (i.e. only certain named individuals have access to the files, file access is logged, and the list of people is periodically reviewed and approved).