Something to share with the community, working with my awesome Cypress FAE we determined that the BLE on PRoC and PSoC4 at least use the free SFLASH for the bonding data for any bonded devices. That is why you are limited to only 4 devices, there are only four free SFLASH areas.
So if you are using BLE and need to be able to pair more than four phones, your have to use white listing, and if you try to use the SFLASH and store a phone it will over write your data.
PSoC 4 Architecture
Sorry for the confusion. The bonding information stores in the FLASH memory and the maximum number of bonded devices are limited by the BLE stack internal memory.
SFLASH is a user configurable area where user can store their device specific information.