Earlier quoted context omitted.
Does cardholder data ever pass through your infrastructure in any form?
In magento, yes... but the full information is held for a small amount time. The module is self hold no card info its a run once and then destroy.
Not that I am an auditor, but if the data ever hits your environment then you have a level of compliance to maintain.