Store cards securely
A PCI vault for the cards travel platforms hold
Cards from guests and partners are stored with us, and your OTA, PMS or channel manager keeps a token for each one. Manage tokens by API, group cards by booking, property or your own reference, and keep cards current with network tokens.
For OTAs and booking engines, PMS and hotel tech and channel managers
The vault
What the vault holds
One token for the whole card
Number, CVV, the non-sensitive details and the 3D Secure result, behind a single token.
No duplicates if you choose
Send a card that is already stored and get its existing token back.
No limit
As many cards as you need, for as long as you need them.
The region you choose
Cards are stored in the region you pick, to meet local rules.
Your cards, your data
Managing stored cards
You own the data. We store it for you.
Find by your reference
Search cards by your own customer, merchant or booking reference.
Update
Change the expiry date when a guest or partner sends a new one.
Read the safe details
Read a card's non-sensitive details without touching the card number.
Delete
Remove a card when you no longer need it.
CVV rules
The CVV is removed once it has been used, as PCI DSS requires. You decide what "used" means, for the whole account or card by card.
Share by token
Partners who also use PCI Booking can share a card with you by token, without card numbers passing between you.
Access
Who can reach the vault
Known addresses
API access limited to IP addresses you know.
Approved destinations
Cards only go where you allow.
Users and keys
Separate users, each with its own keys and permissions.
Not tied to one payment provider
Cards stored with PCI Booking can be charged through any of our 120+ payment integrations, so a merchant can change payment provider without moving its cards. The cards are your data, and we don't lock you in.
Moving cards in
Already storing cards with another vault or payment provider? Cards can be loaded straight into PCI Booking.
Related: Keep cards on file · Network tokens · Data tokenization
FAQ
Questions about storing cards
Is storing cards with PCI Booking PCI compliant?
Yes. PCI Booking is a PCI DSS Level 1 service provider, assessed every year. The cards sit in our vault, not in your systems, so your systems stay out of PCI scope for them.
How long can we keep a card?
As long as you need, and as many cards as you need. The CVV is the exception: PCI DSS requires it to be removed once it has been used, and you decide what "used" means.
Where are the cards stored?
In the region you choose, to meet local rules.
Are we locked in?
No. The cards are your data, and we don't lock you in.
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.