Your card vault shouldn't have an .xlsx extension.
Somewhere in your office there's a spreadsheet full of client card numbers. Everyone knows about it. Nobody talks about it. Card Vault replaces it in an afternoon — no developer required.
Free plan · vault up to 5 cards · no sales call required
| A | B | C | D | |
|---|---|---|---|---|
| 1 | Client | Card Number | Exp | CVV |
| 2 | D. Kowalski | 4532 7811 20XX XXXX | 04/27 | 831 |
| 3 | M. Tran | 5454 9022 51XX XXXX | 11/26 | 204 |
| 4 | Hartley LLP (retainer) | 4716 3390 88XX XXXX | 08/27 | 577 |
| 5 | R. Okafor | 4024 0071 33XX XXXX | 02/28 | 119 |
| 6 | S. Whitfield | 5155 6480 02XX XXXX | 06/26 | 445 |
Why the spreadsheet has to go
It doesn't matter how careful your office manager is. The format itself is the breach. Want the full picture, requirement numbers and all? Read the guide →
It's a breach of everyone, all at once
One phished mailbox or one lost laptop and every client card leaks together — along with your duty to notify each of them.
Storing CVV codes is flatly prohibited
PCI DSS forbids storing the security code after authorization — in any form, encrypted or not. Most card spreadsheets have a CVV column. That's not a finding to remediate; it's a violation, ongoing.
"Password-protected" is not encryption
Workbook passwords, hidden tabs, and a file named Q3_misc.xlsx protect you from nobody. Copies live in sent mail, backups, and the previous treasurer's laptop.
Professional duty makes it worse
Your clients trusted you with their cards because they trust you, period. Explaining a card breach is bad for any business — for a firm that trades on confidentiality, it's existential.
Retire the spreadsheet in four steps
Runs entirely from the Card Vault console — the same person who kept the spreadsheet can run the vault.
Request
Send each client a secure card request by email. They enter their card on a Card Vault-hosted page — it never passes through your inbox.
Vault
Cards land in the vault, encrypted, one by one. Your spreadsheet loses a row every time a link comes back.
Charge
Bill retainers, service contracts, and recurring invoices from the virtual terminal or by API. When the last row is re-vaulted: delete the file. For good.
If your "vault" is a file, this page is for you
Law & professional firms
Client cards for retainers and recurring billing — held to the standard your engagement letter promises.
Agencies & bookkeepers
Bill many clients month after month — each card vaulted once, charged by token forever.
Trade & field services
Deposits, progress billing, and service contracts — charge the card on file when the work is done.
Clubs & nonprofits
Dues and recurring donations work the same way — and the card list survives every change of treasurer.
Property & strata managers
Owner and tenant cards per building — see the dedicated hospitality & property page.
Anyone with "the file"
If this page made you think of a specific filename, you already know. Start free.
Costs less than an hour of anyone's billable time
Start free with 5 cards. Most firms fit in Basic Vault at $79.99/mo (up to 400 stored cards). Full pricing →
Delete the spreadsheet.
Keep the clients.
Sign up in minutes. Send your first card request today — free.
Want the technical detail instead? Platform overview · Docs