It is not necessary to store cardholder data forever. You must define a retention policy to purge unused cardholder data after some time.
You may want to use a period of 13 months if you have customers on yearly plans that will pay once every 12 months.
CloudBlue Commerce stores cardholder data encrypted in its Database.
CloudBlue Commerce allows you to automatically purge unused cardholder data. You can find this option in System > Settings > Payments Processing > More.
To be PCI compliant, you must activate "Enable wipe-out of sensitive data" and set "Delete Payment method if card not used more than (hours)" to your retention period in hours. For example, the value 9360 will have CloudBlue Commerce automatically wipe unused cards after 13 months (24h*30d*13m).