Storing payment credentials safely.
WHAT A TOKEN IS
A substitute value representing a payment instrument.
WHAT MAKES IT SAFE
It has no value outside the system that issued it.
WHAT A VAULT IS
The secure store holding the real values, mapped to tokens.
WHO SHOULD OPERATE ONE
A provider, almost always.
WHY
Operating a vault brings the full weight of card data compliance.
WHAT PROVIDER TOKENISATION PROVIDES
Charging again without ever holding card data.
WHAT NETWORK TOKENISATION ADDS
Tokens issued by the scheme itself, updated when cards are reissued.
WHY THAT MATTERS
Recurring payments survive card replacement.
WHAT TOKENS TO STORE
The token, and display information: last digits, brand, expiry.
WHY DISPLAY INFORMATION
Customers must recognise which card is stored.
WHAT TO NEVER STORE
The full number, unless you operate a compliant vault The security code, ever
WHAT TOKEN SCOPE MEANS
A token usable only by the merchant it was issued to.
WHY THAT MATTERS
A stolen token is worthless elsewhere.
WHAT TO CHECK
Whether your provider's tokens are scoped, and whether they port on migration.
WHY THAT SECOND POINT
Non-portable tokens lock you to a provider.
