Tokenization
Replacing card numbers and sensitive data with tokens — so fewer systems ever see a real PAN, and PCI DSS scope shrinks with them.
How a request moves through it
Capture
Card data enters through a secure field or terminal.
Vault
The PAN is encrypted and stored in the token vault.
Issue
A token is returned in its place.
Use
Downstream systems store and pass the token, never the PAN.
Detokenise
Only authorised services exchange the token for the PAN.
What goes in, and what comes out
- A card number at checkout
What happens: Vaulted and replaced
Comes out: A token the merchant can store
- A wallet provisioning request
What happens: Verified and mapped to a device token
Comes out: A card in the customer’s wallet
- A refund on a stored card
What happens: Token detokenised inside the vault
Comes out: A refund without the PAN leaving scope
Controls built into every step
Safeguards we design in from the start rather than add for an audit.
- PANs encrypted under HSM-protected keys
- Detokenisation restricted to named services
- Format-preserving tokens where legacy systems need them
Questions buyers ask
It depends on the systems it connects to. A scoping session gives a realistic plan for your estate.
Tell us what you’re trying to build
Whether you’re modernizing a banking platform, launching a payment product, or securing existing infrastructure, we’ll help define the right path forward.