Glossary
PAN (primary account number)
The PAN, primary account number, is the card number: 13 to 19 digits, usually 16, made of the BIN that identifies the issuer, the cardholder's account identifier and a final check digit computed with the Luhn algorithm. It is the field PCI DSS exists to protect: it may be stored only encrypted or hashed, displayed only masked to the first six and last four digits, never logged, and never sent over an unprotected channel. In modern platforms it is replaced by a token everywhere except inside the vault.
What may be kept and shown
The first six or eight digits and the last four, for routing, risk and support; a hash for matching the same card across payments; the full number only in the vault, encrypted under managed keys. The security code may never be stored after authorisation, even encrypted; the expiry date and the cardholder name may be stored with the number under the same protection.
Why it matters to a payment business
Every system that sees the PAN is in PCI scope: the checkout page, the servers that take it, the logs, the backups. Keeping the PAN inside a vault and a hosted checkout, and working with tokens elsewhere, is what makes the rest of the platform and every merchant on it cheap to secure and audit.
On the platform
In Tranzify the PAN enters through the hosted checkout, goes to the vault and is replaced by a token; the journal, the back office, the webhooks and the reports show only the masked form, and the vault decrypts the number only inside a request to an acquirer.
Updated: 2026-11-08