Destination management companies
Card payments for DMCs, without card numbers in your inbox
Tour operators, agents and travellers send you cards by email, by phone and in booking messages. Hotels, coach companies and venues wait to be paid. PCI Booking keeps every card in a secure vault, gives your systems a token, and sends the card on or charges it when your team needs it.
Where card data goes
From the tour operator to the hotel, without the card in your systems
Step 1
Cards arrive
A tour operator, OTA or agent sends a booking with a card or a virtual card. A traveller pays a deposit through a link or on your website.
Step 2
The vault keeps them
Each card goes into the PCI Booking vault. Your reservation system, inboxes and spreadsheets hold a token instead of the card number.
Step 3
Your team works with the token
Charge a deposit or a balance, check the card's issuing country against the booking, or show the card to a colleague who needs to see it.
Step 4
Suppliers get paid
Send the card to the hotel, coach company or venue, by secure link or straight into its system. Or issue a virtual card through your own provider.
What changes for your team
Collect, pay suppliers, charge
Collect without the inbox
For a booking taken by phone or message, send the traveller a secure link by email or SMS. On your website, a card form in your branding takes cards, wallets and, in select countries, bank payments. Cards from partners are captured as they arrive, in the format each partner already sends.
Pay hotels and suppliers
Show a card to a hotel through a secure link protected by a one-time password, or send it to the supplier's system in the format it expects. Pay with virtual cards issued through your own provider: each one is stored as a token and sent like any other card.
Charge in every market
Charge deposits and balances through the payment provider and merchant account you pick for each transaction, in any currency that provider supports, with fallback providers if a charge fails. One API across 120+ integrations.
Built for supplier-heavy travel
Where PCI Booking fits a DMC best
Corporate travel and MICE
One event means a venue, several hotels, transfers and activities, each paid separately and often on a deadline.
Group travel
Deposits and balances from many travellers, and rooming lists spread across several hotels.
Luxury and bespoke travel
Itineraries arranged by phone and message, which is where card numbers most often end up in email.
Multi-destination tour operators
Suppliers in several countries, partners sending cards in their own formats, and payment providers that differ by market.
Capabilities that solve it
The parts of PCI Booking a DMC uses
Receive cards from partners
Cards from tour operators, OTAs and agents, captured from their messages, APIs or files.
Take card details by link
A secure email or SMS link for bookings taken by phone, message or an agent.
Share cards with staff and suppliers
Show the card to a hotel by link, or forward it to a supplier's system.
Charge through any PSP
Your own payment providers, chosen per transaction. One API across 120+ integrations.
Store cards securely
A PCI DSS Level 1 vault, for as many cards as you need, for as long as you need them.
FAQ
Questions DMC teams ask
We are a DMC, not a software company. How do we connect?
PCI Booking works through an API, connected to your reservation or booking system. If your own developers built that system, they use the free sandbox and our documentation. If a vendor runs it, tell us which one. Either way, our team helps design the set-up and the integration at no charge.
Do we have to stop taking bookings by phone?
No. While the traveller is on the phone, your agent sends a secure link by email or SMS. The traveller enters the card in a form, and your agent never hears, sees or types the number.
Can a hotel see a card without signing up to PCI Booking?
Yes. We send the hotel a secure link. Authorised staff open it, confirm with a one-time password and view the card in a secure form. The card is not emailed and does not pass through your systems.
Do you issue virtual cards?
Not ourselves. You keep your account with your virtual card provider, and PCI Booking issues cards through it with one API. Each card is stored as a token, ready to send to the supplier. If your provider is not connected yet, we add it at no extra cost.
Does this take us out of PCI DSS?
Card data comes to PCI Booking, not to your systems, so much less of your business is in PCI DSS scope. What is left depends on what else touches cards, and your assessor decides. Check where you stand.
What does it cost?
You pay per card operation: tokenizing, sending, showing or charging a card, with volume discounts. The sandbox and support during the build are free, and you pay only when you go live. See the pricing page, or tell us your monthly booking volume for a quote.
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.