The card-flow hub
for travel
Your platform moves the booking.
We move the card that comes with it.
Every booking brings a card. Here is where it goes.
Cards in
From guests, partners and files, straight to the vault.
Cards stored
One token for the whole card. The card stays in our PCI DSS Level 1 vault.
Cards out
To payment providers, hotels, suppliers and staff.
Outcome
A smaller PCI DSS scope and a simpler audit.
Cards arrive from OTAs, channel managers and GDSs you do not control.
Cards reach us, not your systems
- From partner systems, by API, pushed or pulled. Partners change nothing, and ready-made profiles cover the major OTAs, channel managers and GDSs.
- In any format, with each partner's own encryption and signing.
- From guests, through a hosted card form with 3D Secure.
- By secure link in an email or SMS, for bookings taken by phone or by an agent.
- In files by SFTP, tokenized before they reach you.
The card form is an illustration.
A card taken in March may be charged in August, and every copy in between needs protecting.
The card stays in the vault. You work with a token.
- One token holds the whole card: number, CVV, expiry and the 3D Secure result.
- The same token however the card arrived: from a guest, a partner, a file or another provider.
- Cards on file for deposits, later charges and balance payments, with the 3D Secure data kept with the token.
- Your systems store and pass around tokens in place of card numbers.
- Stored in the region you choose, in a vault certified to ISO 27001:2022.
- Network tokens that keep cards current.
After the booking, the card has to reach the hotel, the supplier or the payment provider.
Charge it, send it or show it, without handling it
- Charge, pre-authorize, capture, refund or void through 120+ integrations with one API.
- Each merchant charges through its own payment provider, and you manage all their accounts in one place.
- Send a card to a hotel, supplier or partner system in the format it expects.
- Show a card to your staff or partners by one-time link, protected by a one-time password.
- Issue virtual cards through your own provider to pay suppliers. Each card is stored and sent on like any other.
- Share a card with a partner that also uses PCI Booking, by token, with no card number passed.
Every system that touches a card is in PCI scope: booking engine, reservations desk, back office.
Less to assess, less to protect
- Card data never touches your systems, so they stay out of PCI scope.
- A smaller scope simplifies your annual audit.
- PCI DSS Level 1 service provider since 2016, on PCI DSS v4 since December 2023.
- Attestation of Compliance and Shared Responsibility Matrix on request.
Where card data goes
The booking's card goes through us. You keep a token.
Who it is for
Built for the platforms between travel partners
Travel technology
Bedbanks, wholesalers, tour operators, TMCs and every travel platform that takes cards from one partner and passes them to another.
OTAs and booking engines
Take the traveller's card on your site, then pass it to the hotel, the supplier or your own payment provider without holding it.
PMS and hotel tech
Take cards from every channel and let each property charge through its own payment provider.
Channel managers and distribution
Pass cards from OTAs and GDSs to properties, each in the format it expects.
Beyond travel
If card details reach you from customers or partners, or you pass them on, the same approach applies. Tell us about your card flows. Talk to us
Integrations
120+ integrations. Don't see yours? We add it free.
Tell us which payment provider you need and we build the connection at no cost to you.
Questions teams ask before they start
What does going live involve?
The PCI Booking integration itself touches only a few parts of your system. Most of the work is around it: your payment pages, your partners' connections and your payment provider's certification. A solutions engineer designs your card flows and the integration with you, free, and you build against a free sandbox.
Already storing cards somewhere else?
We can bring your existing cards into the vault.
How is it priced?
You pay per card operation: tokenizing, sending, showing or charging a card. The sandbox and the build support are free; you pay only when you go live.
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.