Cards
Card vault
A PCI-DSS-compliant store of tokenised card credentials that lets a merchant charge a card again without holding the PAN.
A card vault is a secure, PCI-DSS-compliant environment used to store sensitive primary account numbers (PANs) by converting them into non-sensitive tokens for recurring use. By offloading card data to a vault, typically managed by a third-party gateway or payment service provider (PSP), a merchant reduces their compliance burden and mitigates the risk associated with data breaches. The vault maps a specific payment token to the underlying card credentials, allowing the merchant to initiate subsequent transactions for subscriptions or card-on-file purchases without handling raw cardholder data directly. Modern vaulting solutions often integrate with network tokenisation services provided by Visa and Mastercard, which ensure that the stored payment credentials remain valid even if the physical card is reissued or expires. This integration helps maintain higher authorisation rates and reduces involuntary churn caused by expired card details, as the issuer and scheme can update the token records in the background without merchant intervention.
Frequently asked
How does using a vault impact a merchant's PCI-DSS scope?
Utilising a third-party vault can significantly reduce a merchant's PCI-DSS audit requirements, often allowing them to qualify for simpler Self-Assessment Questionnaires like SAQ A or SAQ A-EP. Because the merchant never stores, processes, or transmits raw PANs on their own servers, the security obligations for their internal infrastructure are greatly diminished.
What is the difference between a PSP-specific vault and a vault-agnostic solution?
A PSP-specific vault ties the tokens to a single acquirer, which can lead to vendor lock-in because those tokens may not be portable to a different gateway. A vault-agnostic or independent vault provider allows the merchant to store data centrally and route transactions to multiple acquirers, providing greater flexibility and redundancy in their payment stack.
Related terms
A scheme-issued token that replaces the PAN end-to-end and is automatically updated when the underlying card is reissued.
Replacing sensitive card data with a non-sensitive surrogate value that can be stored and reused without PCI scope.
The Payment Card Industry Data Security Standard, the scheme-mandated framework for handling cardholder data.
A charge initiated by the merchant against a previously stored credential, without the cardholder present.
Ready for velocity?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.