A retail organization processes credit card transactions and needs to reduce PCI DSS scope by ensuring that sensitive payment card data is not stored in their e-commerce application database. The solution must allow the organization to reference transactions for refunds and chargebacks while minimizing the risk of data exposure. Which data protection method should be implemented?