Vault once.
Charge anywhere.
Card Vault keeps your customers' cards safe and on file — for deposits, dues, retainers, and monthly billing — so your team can charge them when it's time without ever seeing a card number. PCI DSS v4.0.1 compliant. No developer required.
Free plan · vault up to 5 cards · no sales call required
sent from the console — by email or SMS
Stop taking card numbers over the phone
If cards reach you today by phone, email, or front desk, Card Vault replaces every scribbled PAN with one safe workflow your team runs from the console.
Request
Send a secure card request by email or SMS. Your customer enters their card on a Card Vault-hosted page.
Vault
The card goes straight into the vault. It never touches your inbox, your files, or your systems.
Charge
Charge from the virtual terminal when it's time — or by API on your schedule.
Out of scope by design
The fastest way to pass a PCI assessment is to have nothing to assess. Card Vault removes cardholder data from your environment entirely — not encrypted in your database, not passing through your API, just gone. New to scope? Read the plain-English guide →
Card data never touches your stack
Hosted fields and direct-to-vault flows post card data straight from the customer's browser to Card Vault. No PAN in your logs, your database, or your application memory.
Qualify for SAQ A where flows allow
With capture, storage, and transmission handled by Card Vault, eligible integrations can trade the 250+ question SAQ D for the far smaller SAQ A.
Audit trails included
Every token operation — create, use, update, delete — is logged and reportable, supporting your evidence collection instead of adding to it.
Card Vault is assessed annually against PCI DSS v4.0.1 as a service provider (SAQ D). Our Attestation of Compliance is available to customers on request — see Security & Compliance.
Your processor is a setting, not a commitment
Because Card Vault holds the credential — not your gateway — switching or adding processors never means re-collecting a single card. Route new business to a new gateway tomorrow; every stored card comes with you.
The industries we serve best
Anywhere a card has to be kept, not just charged once — that's Card Vault territory.
Hotels, resorts & property managers
Cards on file for incidentals, deposits, and owner billing — requested by link, never read across the desk or over the phone.
Card Vault for hospitality →
Memberships, clinics & billing on file
Gyms, healthcare, utilities, insurance — anywhere a customer's card stays on file for monthly billing, without living in your systems.
Retire the spreadsheet →
Call centers & phone orders
Agents send card onboarding links or charge vaulted tokens so card numbers stay off desks and out of call recordings.
See the workflow →
E-commerce & SaaS platforms
Embedded fields and charge-by-token APIs — checkout stays yours, PCI scope stays ours.
Card Vault for developers →Everything around the vault
Vaulting is the core. These are the tools your team uses every day on top of it.
Virtual terminal
Charge vaulted cards from the browser — no card numbers read over the phone into a keypad.
Transaction logs
Full history of every authorization, capture, and refund, tied to tokens, not PANs.
Vault segmentation
Give each location or property its own segment under one account, with per-segment user access.
Card verification
Validate a card before you rely on it — catch bad numbers before the first billing run.
Webhooks
Signed event notifications for card lifecycle changes: expired, updated, removed.
Third-party authorization
Present your terms and have the cardholder accept them when they add a card — an optional agreement captured with the vault. Goodbye, paper forms →
Start free. Scale by vault size.
Every account starts on the free Starter Vault — sign up and vault your first cards today, then upgrade inside the console when you need more capacity.
- Card requests via email
- Standard hosted form
- API integration
- Card requests via email & SMS
- Hosted + iframe-embedded forms
- Third-party authorization
- 1 payment gateway
- Virtual terminal & transaction logs
- Vault segmentation
API $0.030/call
- Everything in Basic
- Up to 2 payment gateways
- User enrollment
API $0.025/call
- Everything in Professional
- Custom form hosting
- Unlimited payment gateways
- White label options
API $0.020/call
Vault Segment add-on
One vault, many locations — each property gets its own segment with scoped user access.
Per-call rates apply only to the metered operations shown (card verification and API calls) — vaulted cards themselves are covered by your plan.
Frequently asked questions
What is Card Vault?
Card Vault is a credit card vaulting and tokenization platform. It captures, encrypts, and stores payment cards on your behalf, and hands your systems a token to use in their place — for card-on-file billing, recurring charges, and virtual terminal work.
How do I get started?
Sign up free — no sales call, no contract. The Starter Vault lets you store up to 5 cards, use the hosted form, and integrate the API. When you need more capacity, upgrade from inside the console.
How does Card Vault reduce PCI scope?
Card data is captured through Card Vault-hosted surfaces and posted directly to the vault, so it never enters your servers, logs, or database. Integrations that keep card data entirely out of your environment can qualify for SAQ A where the eligibility criteria are met.
Is Card Vault itself PCI DSS compliant?
Yes. Card Vault is assessed annually against PCI DSS v4.0.1 as a service provider (SAQ D). Our Attestation of Compliance is available to customers on request — details on the Security & Compliance page.
Is Card Vault processor-agnostic?
Yes. Tokens belong to the vault, not to a gateway. You can connect one processor or several, add another later, or switch entirely — stored cards keep working without re-collecting anything from your customers.
Can I get my card data out if I decide to leave?
Yes — your customers' credentials are yours, not ours. If you ever leave, we support a secure, PCI-compliant migration of your stored cards to another compliant vault or processor. No lock-in is the whole point of an independent vault. Refer to our Terms of Use as some conditions do apply.
Does Card Vault eliminate all PCI requirements?
Not automatically. Your obligations depend on your full environment and processes. Card Vault is designed to shrink your scope dramatically and support your compliance workflows, but final scope is determined by how you integrate and operate.
Put your card data somewhere
it can't hurt you.
Sign up in minutes. Your first five cards are free — no sales call required.
Prefer to read first? Browse the docs.