[Eyes2design]

In magento, yes... but the full information is held for a small amount time. The module is self hold no card info its a run once and then destroy.

[rpug]

Not that I am an auditor, but if the data ever hits your environment then you have a level of compliance to maintain.