Tokenization
PCI tokenization and detokenization
We swap each card number, whether it came from a guest, an OTA, a channel manager or a file, for a token your systems can store, and use the card again, through detokenization, only when you send the token with an instruction.
For OTAs and booking engines, PMS and hotel tech and channel managers
Card in, token out
Tokenization
One token for the whole card
Number, CVV, non-sensitive details and the 3D Secure result, behind a single token, so one call uses the whole card.
Whatever the source
A guest's card form or card link, a partner's API, a file or an upload from another provider: every card becomes the same kind of token.
No duplicates if you choose
Send a card that is already stored and get its existing token back, instead of a new one.
Token in, card used
Detokenization
Tokenize a card once and retrieve it whenever you need it: send the token with an instruction, and we use the card. Your systems never see the number.
Charge it
Through any of 120+ payment integrations, with one API.
Send it
To a hotel, supplier or partner system, in the format it expects, or in a file to its SFTP server.
Show it
To your staff or partners, in a secure form or behind a one-time password.
Share it
With a partner who also uses PCI Booking, by token.
What it means for PCI DSS
Card data lives in our vault, not in your systems, so your systems stay out of PCI scope. That drastically reduces your PCI DSS scope and simplifies your annual audit.
Related: All capabilities · How it works
FAQ
Questions about tokenization
What is detokenization?
Using the card behind a token. You send the token with an instruction, such as charge it, send it or show it, and we use the card held in our vault to carry it out. Your systems never see the card number.
Does tokenization take us out of PCI scope?
Your systems stay out of PCI scope for the cards we hold, because they store tokens, not card numbers. A very limited scope can remain, for example web pages that embed our card form. Reduce your PCI DSS scope sets out what changes and what does not.
Is there an API?
Yes. Cards are tokenized, used, searched, updated and deleted through our REST API, and every endpoint is in the developer docs.
Can we tokenize data other than cards?
Yes. Other sensitive data, such as passport numbers, can be stored in the vault the same way, and your systems keep a token for it.
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.