Card Vault
Store cards once. Charge them on any processor.
A PCI DSS compliant vault that belongs to you, not your processor. Save a card once and route it anywhere, today and after you switch.
- Stripe
- Worldpay
- Authorize.net
- Mastercard Gateway
- Airwallex
- PayPal
Why a vault you own
Your customers' cards should not be locked to one processor.
Route a saved card anywhere
Each record keeps a token for every processor account it has been charged on, so routing rules apply to returning customers too.
Leave a processor, keep your customers
Your cards live in your vault, not your processor's. Switching or adding a processor does not touch your customers' saved cards.
Card fingerprinting
Recognise the same card across customers and stores, for fraud checks and loyalty, without decrypting it.
Network tokens
Charge with Visa and Mastercard network tokens instead of the raw number, for higher approval rates on stored cards.
Card account updater
When a bank reissues a card, the vault picks up the new number and expiry so renewals keep going through.
Out of PCI scope
Cards are captured in a form we host on an isolated domain. Your servers never see a card number.
Inside a vault record
What we keep, and what we refuse to.
Every saved card is one record you own. Here is everything on it.
- Card number
- AES-256-GCM, versioned keys
Encrypted before it reaches the database. A record cannot be written without the key.
- Card fingerprint
- HMAC-SHA256
Spots the same card across customers and stores without decrypting anything.
- Processor tokens
- One per processor account
Each processor's own token sits on the record, so a saved card keeps working wherever you route it.
- Card attributes
- Brand, type, level, country, issuer
Ready for routing rules and reporting without a second lookup.
Never stored
- The security code (CVV). It is used once to authorise, then dropped.
- Card data in logs. Numbers, codes and expiry dates are masked before anything is written.
- Card data on your servers. It is captured in an isolated card form we host.
How it works
From first purchase to every renewal after it.
Capture
The customer types their card into the Orchestrapay payment form. It is encrypted and vaulted before your page gets a reference back.
Charge
Pay with the saved card from your server or your checkout. Routing picks the processor, and the vault hands it the card or its token.
Keep
The card stays in your vault across processors, migrations and outages, ready for the next renewal or one-click purchase.
Questions teams ask before they switch.
A card vault is a secure store for your customers' card details. Instead of each processor keeping its own copy, Orchestrapay keeps one encrypted record per card that you can charge on any processor you connect.
Bring your cards. We will handle the migration.
Tell us where your cards are stored today and how you process. We will map the import with your current processor and show you what it costs.
- Cards migrated processor to vault
- No customer asked to re-enter a card
- A transparent number before you sign anything