Payment Tokenization & Secure Vaulting
Protect Credit Card and ACH Data While Maintaining Control Over Your Payment Infrastructure
HostedPCI provides payment tokenization and secure vaulting services that allow businesses to collect, store, and reference sensitive payment information without retaining original card or bank account numbers in their own applications.
Our tokenization solution replaces credit card numbers and ACH account information with unique HostedPCI tokens, while the original data is maintained within a protected, merchant-specific payment vault.
These tokens can be used within supported payment workflows, allowing businesses to securely manage payment information while maintaining flexibility across multiple payment gateways.
Built on HostedPCI’s PCI DSS Level 1 infrastructure, our payment vaulting services support eCommerce, call centers, enterprise applications, and businesses that require secure payment data storage.
Contact Sales | Explore Our Services
What Is Payment Tokenization?
Payment tokenization replaces sensitive payment information, such as a credit card’s Primary Account Number (PAN) or an ACH bank account number, with a token that represents the original data.
Instead of storing original payment details in their own systems, businesses can retain HostedPCI tokens for use in supported payment transactions.
The original payment information is maintained within HostedPCI’s protected payment vault, with each token associated with the corresponding stored data.
This allows businesses to reduce the amount of sensitive payment information stored within their environments while supporting their existing payment workflows.
How Does HostedPCI Payment Tokenization Work?
HostedPCI provides multiple methods for collecting and tokenizing payment information, depending on the merchant’s payment environment.
1. Collect Payment Information
Payment details are collected through a supported HostedPCI solution, such as an eCommerce iFrame, Call Center IVR, or direct API Tokenization integration.
The collection method determines whether sensitive payment data passes through the merchant’s environment.
2. Generate a HostedPCI Token
HostedPCI generates a token representing the collected card or bank account information.
For credit cards, HostedPCI supports configurable token formats that can preserve selected portions of the original card number for identification purposes.
3. Store Payment Data in a Dedicated Vault
The original payment information is maintained within a merchant-specific HostedPCI vault.
Each merchant has separate staging and production vault environments, with tokens associated with the vault in which they were created.
4. Use Tokens for Supported Payment Transactions
Merchants can submit HostedPCI tokens through supported payment integrations.
HostedPCI resolves the token within its environment and provides the required payment information to the configured payment destination.
This allows businesses to process supported transactions without retrieving the original payment data into their applications.
Key Features of HostedPCI’s Payment Vault
Merchant-Specific Payment Vaults
Each merchant receives its own designated payment vault environment, separating its stored payment information from other HostedPCI merchants.
Separate Staging and Production Vaults
HostedPCI provides separate vault environments for testing and live payment operations.
Tokens are specific to the vault where they were generated and cannot be used interchangeably between staging and production vaults.
Credit Card and ACH Tokenization
HostedPCI supports tokenization and storage of both credit card information and ACH bank account details.
Businesses can use the applicable HostedPCI collection and API integrations for each payment type.
Customizable Credit Card Token Formats
HostedPCI’s standard credit card tokens are 16 digits long and can retain the first four and last four digits of the original PAN.
Additional supported token structures include formats that preserve different portions of the card number, including six-digit and eight-digit BIN configurations.
These options allow businesses to select supported token formats that fit their payment application requirements.
Multiple Payment Gateway Support
HostedPCI’s independent payment vault works with multiple supported payment gateways.
Merchants can use HostedPCI tokens across compatible gateway integrations without relying exclusively on one payment gateway’s proprietary token format.
Token-Based Payment Processing
Stored payment credentials can be referenced through HostedPCI tokens in supported payment workflows.
This helps businesses process transactions without retaining original card numbers within their applications.
Payment Gateway Independence and Flexibility
Many payment providers offer tokenization services tied to their own processing platforms.
When payment data is stored using a gateway-specific token, businesses may face additional technical requirements when introducing another payment provider.
HostedPCI provides an independent payment vault that is separate from the payment gateway.
Merchants can use HostedPCI tokens with supported payment gateway integrations, allowing them to maintain greater flexibility in their payment processing architecture.
This approach can be valuable for businesses that operate multiple merchant accounts, work with several payment providers, or need to introduce additional gateways.
Gateway compatibility and available transaction features depend on the specific integrations.
View Supported Payment Gateways
Multiple Ways to Collect and Tokenize Payment Data
HostedPCI offers several payment collection methods that connect to its tokenization and vaulting infrastructure.
eCommerce iFrame Tokenization
Collect credit card information through HostedPCI-hosted payment fields embedded within your website.
The card details are submitted directly to HostedPCI rather than passing through your application’s servers.
API Tokenization
Continue using existing payment collection systems and submit collected card information to HostedPCI through the Tokenization API.
This allows businesses to outsource storage of original card numbers while maintaining their established collection process.
ACH Tokenization
Replace bank account numbers with HostedPCI tokens and maintain the underlying account information within HostedPCI’s protected vault.
Tokens can be referenced within supported ACH payment workflows.
Call Center IVR
Collect card information through secure telephone and SMS payment workflows without requiring agents to directly handle sensitive card details.
HostedPCI’s IVR solutions support tokenization of collected payment information.
Payment Vaulting for Different Business Requirements
eCommerce and Subscription Platforms
Store tokenized payment information for supported card-on-file and repeat payment workflows without retaining the original card numbers in your application.
Enterprise Payment Orchestration
Use a gateway-independent payment vault to support transactions through multiple configured payment gateways.
Travel and Reservation Platforms
Securely store payment information collected during bookings and reference it when a supported payment transaction is required later.
Insurance and Contact Centers
Tokenize card information collected through supported call center payment solutions while accommodating multiple merchant account configurations.
SaaS and Customer Payment Portals
Integrate tokenization and payment vaulting into applications that require secure payment data collection and storage.
Payment Vault Security and PCI DSS Compliance
HostedPCI provides payment card tokenization and vaulting through PCI DSS Level 1 validated infrastructure.
By keeping original card numbers in HostedPCI’s payment vault, merchants can reduce the need to store sensitive cardholder data within their own systems.
However, the PCI DSS responsibilities of each business depend on how payment information is collected, transmitted, and used.
For example, HostedPCI-hosted iFrame collection and direct API Tokenization have different implications for merchant PCI DSS scope.
Tokenization does not automatically eliminate all PCI DSS obligations, and merchants must secure their payment applications and integration credentials.
For ACH data, applicable bank payment security requirements are separate from PCI DSS cardholder data requirements.
HostedPCI Payment Vaulting in Practice
Travel: Secure Payment Storage for Booking Workflows
A travel business needed to securely collect card information during its booking process and retain access to that information until the payment was required.
HostedPCI’s tokenization and vaulting infrastructure supported secure collection and storage, allowing the business to reference payment information within its booking workflow.
Insurance: Tokenization Across Multiple Merchant Accounts
An insurance organization required secure card collection and storage across seven call center merchant account configurations.
HostedPCI provided tokenization and payment infrastructure that supported the organization’s separate processing arrangements.
Explore HostedPCI Success Stories
Frequently Asked Questions
What is a payment vault?
A payment vault is a protected environment used to store sensitive payment information, including credit card numbers and supported bank account details.
HostedPCI stores the original payment information and provides tokens that merchants can reference in supported payment workflows.
What is the difference between tokenization and vaulting?
Tokenization replaces sensitive payment information with a token.
Vaulting provides the protected storage environment where the original payment information is maintained.
HostedPCI combines these capabilities to help businesses store and use payment information without retaining original account numbers in their own applications.
Does HostedPCI provide a separate vault for each merchant?
Yes. HostedPCI provides merchant-specific vault environments, including separate staging and production vaults.
Tokens generated in one vault cannot be used interchangeably with another vault.
Can HostedPCI store both credit card and ACH information?
Yes. HostedPCI supports tokenization and secure storage for both credit card and ACH account information through supported collection and payment integrations.
Can HostedPCI tokens be customized?
Yes. HostedPCI supports configurable credit card token formats, including its standard 16-digit format that retains the first four and last four digits of the original card number.
Additional supported structures are available for different requirements.
Can HostedPCI tokens be used with multiple payment gateways?
Yes. HostedPCI supports using its independent tokens through multiple compatible payment gateway integrations.
The available payment capabilities depend on each gateway integration.
Does HostedPCI replace my payment gateway?
No. HostedPCI provides tokenization, payment vaulting, and payment integration infrastructure. Merchants can continue working with supported payment gateway providers.
Can HostedPCI tokens be used for future transactions?
Yes. HostedPCI tokens can be referenced for subsequent supported payment transactions, subject to gateway functionality and applicable cardholder authorization requirements.
Does HostedPCI tokenization eliminate PCI DSS requirements?
No. Tokenization can help reduce the storage of sensitive cardholder data within merchant systems, but PCI DSS scope depends on how payment information is collected, transmitted, and processed.
Secure Your Payment Data With HostedPCI
Protect sensitive payment information while maintaining flexibility across your payment systems.
HostedPCI combines credit card and ACH tokenization, merchant-specific payment vaults, configurable token formats, and multiple payment gateway integrations to support secure payment data management.
Whether you’re building a new payment application, supporting multiple gateways, or looking to reduce the storage of sensitive payment data within your systems, HostedPCI can help you evaluate a suitable tokenization and vaulting solution.
Contact Sales | Get Pricing | View Documentation
Case Studies
Travel
This merchant required the ability to collect and store credit cards securely from their booking page until required for payment. The transaction process starts with the first 2 requests being sent to the airline company to determine if tickets were available and then the 3rd transaction needs to be sent securely with the credit card number to the airline.
Municipality
This municipal merchant of ours required the ability to accept credit cards from their clients in a PCI compliant way in order to reduce their PCI scope as much as possible. The biggest trouble was to collect the customer’s card over the phone while being able to provide guidance to their clients regarding the transaction process and also collect the card during off hours with an unassisted IVR.
Insurance
This merchant needed the ability to securely collect and store the credit card information that they received from their customers within their call centres and then send this information along with the customer data over to their designated Payment Gateway to complete the transaction. In this case the merchant had a different merchant account for each of their call centre sites — in total, 7 different gateway merchant accounts needed to be configured.