Glossary
Card vault
A card vault is the isolated system that stores card numbers encrypted under managed keys and hands out tokens in their place; every other part of the platform, every merchant and every report works with the token. The vault is the one component in full PCI DSS scope, which is what keeps the others out of it. A vault owned by the payment business rather than by an acquirer lets a stored card be charged through any acquirer the routing picks.
What a vault does
Receives the card number from the checkout over an encrypted channel, encrypts it under a data key from a key management service, stores it in a database separate from everything else, issues a token, and keeps the acquirers’ own tokens for the same card next to it. When a merchant charges the token, the vault decrypts the number only inside the request to the acquirer, or uses the acquirer’s token, and never logs the number anywhere.
Vault ownership
An acquirer’s vault ties stored cards to that acquirer: changing acquirer means asking every payer again. A vault that belongs to the business, or to the platform it runs, keeps the cards when a terminal changes, which is what makes cascading of recurring payments and migration between acquirers possible.
On the platform
Tranzify’s vault stores cards under KMS data keys in an isolated database, issues the platform’s tokens, maps them to the acquirers’ tokens, checks expiries every hour, masks the number everywhere outside the vault and journals every use of a token without the number itself.
Updated: 2026-11-08