State guidelines require that supporting documentation is maintained for three years plus the current year (see University Records Management). The complete cardholder account number and security code need to be eliminated from any document as soon as there is no business need for the information (within 90 Days [PCI]). You may retain a maximum of the first six and the last four digits of the account number with the documentation for the record retention period, but never the Security code (CVV2).