Built to be the safest place your customers' cards can live
PCI DSS compliance
Card Vault is assessed against PCI DSS v4.0.1 as a service provider, completing the full SAQ D self-assessment — the most comprehensive assessment path, covering all applicable PCI DSS requirements for the storage, processing, and transmission of cardholder data.
Our current Attestation of Compliance (AoC) is available to customers and prospective customers on request via the contact form. Compliance is reassessed annually and after significant changes to the environment.
Encryption and key custody
- At rest: cardholder data is encrypted with AES-GCM using 128-bit data keys, and each data key is itself encrypted under a separately held key-encryption key. Primary account numbers are never stored in plaintext, anywhere.
- In transit: all connections require TLS; card capture happens over HTTPS directly from the cardholder's browser to the vault.
- Key custody: encryption keys live in a dedicated, segregated key store with independent access controls — separate from the card data they protect and from the application databases.
- Tokenization: your systems receive an opaque token with no mathematical relationship to the card number. A stolen token is useless outside your account.
Isolation and access control
- Multi-tenant isolation: every token is scoped to your account; cross-tenant access is denied at the data layer on every request.
- Vault segmentation: within an account, segments isolate locations or properties, with per-segment user access.
- Least privilege: card data is masked everywhere by default (last four digits and expiry). Revealing a full card number is a separate, privileged operation — and every reveal is written to the audit trail: who, which card, and when.
Monitoring and auditability
- Every token operation — create, use, update, delete — is logged and reportable, giving you an evidence trail for your own assessments.
- The platform runs behind a web application firewall with centralized security event monitoring and file integrity monitoring across production hosts.
- Card lifecycle webhooks (expired, updated, removed) are signed so you can verify their origin.
No lock-in, by design
An independent vault only makes sense if it stays independent. Your customers' credentials are yours: if you leave Card Vault, we support a secure, PCI-compliant migration of stored cards to another compliant vault or processor. The same portability we promise against gateways, we honor ourselves.
Guidance, advisories and release notes
Card Vault maintains current secure-implementation guidance for every surface a customer integrates with, and keeps it aligned with releases:
- Security advisories — the channel of record when an issue requires customer awareness or action; advisories requiring action are also emailed to your registered security contact.
- Release notes — what changed in each release, security-relevant changes called out, and how to check the version you are running against.
- Windows SDK — coming soon; the integration and verification guide is published when the SDK becomes available.
- Developer docs portal — API reference, hosted fields, webhooks: integration, configuration and operation guidance per surface.
Reporting a security concern
If you believe you have found a vulnerability in a Card Vault service, please report it to security@cardvault.com — policy and terms at /.well-known/security.txt. We review every report and acknowledge within two business days.
About Card Vault Inc.
Card Vault is built and operated by Card Vault Inc. as a payment credential custodian: we store, protect, and route payment credentials on your behalf. We are not a party to the relationships you have with your own customers — we are the safe in the basement. Questions about the company, the platform, or compliance documentation: get in touch.