Card Vault is an independent credit card vault and tokenization platform for businesses that need to keep customer cards on file. It captures, encrypts and stores payment cards for you, and gives your team and your systems a token to use instead. Card numbers never reach your inbox, spreadsheets, files or servers.
It's built for real card-on-file work: deposits, dues, retainers, monthly billing and charges your staff key in. Instead of taking card numbers by phone or email, your team sends a secure card request by email or SMS. The customer enters their card on a page hosted by Card Vault, and the card goes straight into the vault. Staff only ever see the last four digits and the expiry date, and they can charge the card from the console when payment is due. No developer is needed.
Card Vault doesn't depend on any one processor. Tokens belong to the vault, not to a payment gateway, so you can connect one processor or several, add another later or switch completely. Stored cards keep working, and you never have to ask customers for their cards again.
For teams that build their own integrations, Card Vault offers:
- a hosted payment form
- an embeddable iframe
- per-field JavaScript card capture
- a standalone CVV re-verification field for saved cards
- a REST API with webhooks
- a Windows SDK for .NET desktop and line-of-business apps
Network tokenization supports recurring billing, and a sandbox lets you test before going live. Because card data goes straight to the vault, your own PCI scope shrinks. Integrations that keep card data completely out of your environment can qualify for SAQ A when the eligibility criteria are met.
Card Vault is assessed against PCI DSS v4.0.1 as a service provider (SAQ D), and customers can request the Attestation of Compliance. Each tenant's data is kept separate from every other tenant's.
You can start free: the Starter Vault stores up to 5 cards, with no sales call and no contract. Paid plans scale from small offices up to enterprise.
