Skip to content
Book a demo
Back to glossary

Payments

Tokenization

Replacing card details with a meaningless reference, so the sensitive number never reaches your systems.

Tokenization swaps a card number for a token that is useless outside the processor that issued it. Your systems store and charge the token; the card number stays inside the processor.

This is what keeps most subscription businesses within the lightest PCI DSS scope, because they never receive, transmit or store a card number.

Tokens are usually processor-specific, which is what makes changing gateways painful. Network tokens, issued by the card schemes rather than the processor, are portable and generally authorise at higher rates, which is worth asking any gateway about before you commit.

Related terms

  • Card on file A stored payment credential used for future charges, subject to specific network rules and consent requirements.
  • PCI DSS The card industry security standard governing how card data is handled. Most subscription businesses aim to stay in the lightest scope.
  • Payment gateway and processor The gateway routes a transaction; the processor moves the money. Many products do both, which is why the terms blur.