PMS and hotel tech
Card handling for PMS and hotel tech platforms
Cards arrive from OTAs, channel managers and guests, and are tokenized as they arrive. Each hotel charges through its own payment provider. Your PMS holds tokens, not card numbers.
Where card data goes
Cards from every channel, charged through each hotel's own provider
What changes for your platform
Take cards, charge cards, hold tokens
Take cards from every channel
Cards from OTAs and channel managers, virtual cards from Booking.com and Expedia included, come to us by API, HTTP or files and are tokenized on arrival. Guests enter cards in a hosted form or through a secure link. Your PMS stores the token.
Charge through each hotel's own provider with one API
Each hotel keeps its own merchant account, and you manage all of them in one place. Charge, pre-authorize, capture, refund or void through any of 120+ integrations from one API. A provider missing? We add it free.
Keep your platform out of card data
PCI Booking keeps card data out of your systems, which reduces your PCI DSS scope and simplifies your annual audit. Staff see a card only when they need to, in a secure form.
Capabilities that solve it
The parts of PCI Booking a PMS uses
Share cards with staff and suppliers
Show a card to front-desk staff without it landing in your PMS.
FAQ
Questions PMS teams ask
Can each hotel keep its own payment provider?
Yes. Each hotel is set up on its own provider. Your platform makes one API call and says which hotel the charge is for. If a hotel's provider is not among our 120+ integrations, tell us and we add it, free.
How do cards from OTAs and channel managers reach us?
They come to PCI Booking first, by API, HTTP or files, and are tokenized on arrival. The OTAs and channel managers change nothing on their side. Your PMS receives the booking with a token in place of the card number.
Can our hotels accept virtual cards from Booking.com and Expedia?
Yes. A virtual card from Booking.com or Expedia arrives in the booking message like any other card and is tokenized on arrival. The hotel charges it through its own payment provider with one API call from your PMS, and your PMS never holds the card number.
Can front-desk staff still see a card when they need to?
Yes. Authorised staff view the card in a secure form, protected by a one-time password, without the card being stored in your PMS. The card is shown on a page we serve, so your PMS stays out of PCI scope.
What stays in our PCI scope?
Your servers, databases and network stay out of PCI scope: they hold tokens, not card numbers. A very limited scope remains: web pages that embed our hosted card form, your own staff who view cards by display link, and any phone or email channel where staff hear or type a card number. What changes and what does not
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.