1. CDD doesn’t store the unencrypted card data at any point in the scanning.

2. The scanner tools (Both Database and File System Scanning) mask the data before storing in the database.

3. CDD stores and displays only first 6 and last 4 characters of the card data. The remaining characters are masked using the “X” character.