CV
CardVault
PCI DSS 4.0.1–ready
Coming soon

PCI DSS 4.0.1 tokenization & secure card vaulting for modern SaaS platforms

CardVault is a provider‑controlled, PCI DSS 4.0.1–compliant tokenization and credit card vaulting platform for SaaS providers, merchants, and ISVs. Eliminate PCI exposure, secure card‑on‑file workflows, and modernize your payment infrastructure without touching sensitive card data.

SAQ A–oriented architecture
Processor‑agnostic tokens
Multi‑tenant isolation
Compliance & scope reduction

Reduce PCI scope with provider‑controlled tokenization

CardVault removes sensitive cardholder data from your environment entirely. Our secure UI components, cryptographic isolation, and direct‑to‑vault flows ensure your systems never handle PAN, CVV, or other sensitive authentication data.

Qualify for SAQ A
Architected so your application never touches card data, enabling SAQ A eligibility where your payment flows meet the criteria.
Eliminate card data from your stack
No PAN in logs, databases, or application memory. CardVault owns the sensitive surface; you work with tokens only.
Lower audit complexity
Shrink the systems in scope, simplify evidence collection, and reduce the operational drag of annual PCI assessments.
Vault & lifecycle

Securely store and manage customer payment data

CardVault provides a hardened, high‑availability vault for storing and managing card‑on‑file credentials, with full lifecycle controls and auditability.

PCI DSS 4.0.1–compliant vault
Built around the latest PCI DSS 4.0.1 requirements for cryptography, access control, and monitoring.
Processor‑agnostic tokens
Use the same token across processors and gateways, keeping your payment strategy flexible and portable.
Multi‑tenant isolation
Strong tenant boundaries and per‑tenant keys ensure clean separation for platforms and marketplaces.
Developer experience

Integrate CardVault into any app, website, or platform

Our SDKs and secure UI components make integration simple — no sensitive data ever touches your servers.

Secure web elements
Drop‑in hosted fields and iframes for collecting card data in the browser while keeping your app out of scope.
WebForms MVC Plain JS React Vue
Mobile & backend SDKs
Native SDKs for Windows, iOS, and Android will be released shortly after launch, with server‑side SDKs for .NET, Node.js, Python, Java, and more on the roadmap. All server‑side SDKs are designed for token usage only.
Direct‑to‑vault flows
Card data is posted directly from the client to CardVault, with your systems receiving only tokens and metadata.
Security & compliance

Why PCI DSS 4.0.1 compliance matters

PCI DSS 4.0.1 introduces stricter controls around cryptographic key management, tokenization, secure UI boundaries, and monitoring. CardVault is engineered to meet — and exceed — these requirements so you don’t have to rebuild your stack.

Modern cryptography
Strong key management, rotation, and separation of duties aligned with PCI DSS 4.0.1 expectations.
Secure UI boundaries
Hosted components create a clean separation between card data and your application code.
Logging & monitoring
Detailed audit trails for token creation, usage, and lifecycle events to support your compliance story.
Who CardVault is for

Built for SaaS platforms, merchants, and ISVs

SaaS platforms
Offer card‑on‑file billing, subscriptions, and usage‑based pricing without pulling your entire stack into PCI scope.
Merchants
Protect stored cards for repeat purchases, recurring billing, and account‑on‑file experiences.
ISVs & embedded payments
Embed secure payment storage directly into your product while keeping your core application lean and focused.
FAQ

Frequently asked questions

What is CardVault?
CardVault is a PCI DSS 4.0.1–compliant tokenization and credit card vaulting platform that removes sensitive card data from your environment so you can work exclusively with tokens.
How does CardVault reduce PCI scope?
CardVault uses secure UI components and direct‑to‑vault flows so your systems never touch PAN or CVV. You receive only tokens and metadata, enabling SAQ A qualification where your payment flows meet the criteria.
Is CardVault processor‑agnostic?
Yes. CardVault is designed to work with multiple processors and gateways, giving you flexibility to evolve your payment strategy without re‑vaulting cards.
Who should use CardVault?
SaaS platforms, merchants, and ISVs that need secure card‑on‑file storage, PCI scope reduction, and a future‑proof tokenization strategy.