# Card Vault: store cards once, charge them on any processor

Orchestrapay's Card Vault is a PCI DSS compliant store for your customers'
cards that belongs to you, not to a processor. Save a card once and charge it on
any processor you connect, including Stripe, Worldpay, Authorize.net, the
Mastercard Gateway, Airwallex and PayPal. Switch or add processors without asking
customers to re-enter their card.

Page: https://www.orchestrapay.com/products/card-vault

## What it does

- **Route a saved card anywhere.** Each vault record keeps a token for every
  processor account it has been charged on, so routing rules apply to returning
  customers too.
- **Leave a processor, keep your customers.** Cards live in your vault, so
  switching processors does not touch saved cards.
- **Card fingerprinting.** Recognise the same card across customers and stores
  without decrypting it (HMAC-SHA256).
- **Network tokens.** Charge stored cards with Visa and Mastercard network
  tokens for higher approval rates.
- **Card account updater.** Reissued cards are refreshed with their new number
  and expiry so renewals keep going through.
- **Out of PCI scope.** Cards are captured in a payment form hosted on an
  isolated domain, so your servers never see a card number.

## What a vault record holds

- Card number, encrypted with AES-256-GCM and versioned keys.
- A card fingerprint (HMAC-SHA256).
- One processor token per processor account.
- Card attributes: brand, type, level, country and issuer.

Never stored: the security code (CVV). Card data is masked before anything is
logged.

## How it works

1. **Capture.** The customer enters their card in the Orchestrapay payment form;
   it is encrypted and vaulted before your page gets a reference back.
2. **Charge.** Pay with the saved card from your server or checkout. Routing
   picks the processor and the vault supplies the card or its token.
3. **Keep.** The card stays in your vault across processors, migrations and
   outages.

## FAQ

**Who owns the card data?** You do. If you leave a processor, your customers'
cards stay with you.

**Can I import cards from my current processor?** Yes. Most processors export
stored cards to another PCI DSS compliant vault on request; Orchestrapay
coordinates the migration.

## Related

- [Smart Routing](https://www.orchestrapay.com/products/smart-routing.md)
- [PCI DSS Compliance](https://www.orchestrapay.com/solutions/pci-dss-compliance.md)
- [Never depend on one processor](https://www.orchestrapay.com/solutions/processor-redundancy.md)
- [Talk to sales](https://www.orchestrapay.com/contact)