Receive cards from partners

Receive cards from partners without holding them

Receive card details from OTAs, channel managers and GDSs and pass them on to hotels and suppliers, without the card number touching your systems. Cards come to us in API calls you make, in calls they make to you, or in files. Your partners change nothing, and ready-made profiles cover the major senders. You get tokens.

By API, HTTP or file · PCI DSS Level 1 since 2016

For OTAs and booking engines, PMS and hotel tech and channel managers

Where partner cards go

The partner sends the card. Your system gets a token.

Diagram: an OTA or channel manager sends a booking with a card; the PCI Booking vault takes the card out; your system receives the booking with a token.
Diagram: an OTA or channel manager sends a booking with a card; the PCI Booking vault takes the card out; your system receives the booking with a token.

PCI Booking keeps card data out of your systems, which reduces your PCI DSS scope and simplifies your annual audit.

Ways to receive cards

Every route in ends with a token

Tokenize on request

Inbound messages from partners pass through us on their way to you. We replace each card with a token and forward the rest of the message.

Tokenize on response

When your system pulls data from a partner, the request goes through us and the card in the response is replaced with a token.

Files by SFTP

Partners that send cards in files deliver them to us. You receive the file with tokens in place of card numbers.

Push or pull

Partners can push cards to us, or cards can be pulled from the partner, depending on how each partner works.

Ready-made profiles for the major senders

Ready-made profiles for the major OTAs, channel managers and GDSs are set up already, so you do not start each connection from scratch.

Their format, their encryption

Partners keep their own systems and formats: JSON, XML, plain text or URL parameters, with their own encryption and message signing if they use it.

After the card arrives

Use the card without handling it

The token is all your system needs. When it is time to act on the card, you choose what happens.