A token vault is the secure system that stores the relationship between a token and the sensitive data it stands in for, most often a card's primary account number (PAN). When a merchant, wallet or processor replaces a card number with a token, the real number is kept only in the vault, and the token is what circulates through ordinary business systems. When the real number is needed to authorise or settle a payment, an authorised system asks the vault to look it up, a step called detokenisation.
Token vaults are run by token service providers, which include the card networks for network tokens, and by payment processors, gateways and specialist security vendors for their own tokens. Because the vault holds the data that criminals want, it is the most protected component of any payment tokenisation scheme and is subject to strict requirements under the PCI DSS.
How a token vault works
When a card is first captured, for example at checkout, the payment page sends the card number directly to the tokenisation service. The service generates a token, stores the pair in the vault and returns the token to the merchant. The merchant keeps the token in its customer records and uses it for later purchases. At payment time, the token goes to the processor or network, which retrieves the PAN from the vault and forwards the authorisation request to the issuer.
Inside the vault the card numbers are encrypted, and the encryption keys are held separately, usually in a hardware security module (HSM). Access to detokenisation is restricted to specific systems and logged in detail. Vaults are typically replicated across data centres so that a failure does not stop payments, since every tokenised transaction depends on a successful lookup.
Network vaults and processor vaults
Two broad kinds of vault exist in card payments. Network token vaults are run by the card schemes as part of the EMVCo tokenisation framework. They hold the link between network tokens and PANs, enforce domain restrictions so a token issued for one merchant or device cannot be used elsewhere, and manage token lifecycle management events such as card reissue. Processor or gateway vaults hold tokens that are meaningful only to that provider. They protect stored card data but tie the merchant to the provider, because the tokens cannot be used with a different processor unless the vault data is migrated.
Large merchants often use both: a gateway vault for their own records, with network tokens requested behind it for transactions. Some offer card data portability clauses in contracts so that the vault can be exported if they change provider.
Vault-based and vaultless tokenisation
A traditional vault generates random tokens and must store every mapping, so it grows with each card and has to be queried for every detokenisation. Vaultless tokenisation instead derives the token from the card number using format-preserving encryption or a similar keyed method, so the original value can be recovered with the key alone and no lookup table is needed. Vaultless designs scale more easily and avoid replication of a large database, but they depend entirely on protection of the keys, and a compromised key exposes every token at once. Random tokens held in a vault have no mathematical relationship to the PAN, which many security teams prefer. Both approaches are covered in PCI guidance on tokenisation, alongside payment data encryption.
Compliance and security
The main business reason for using a vault operated by a third party is to shrink the merchant's cardholder data environment. If a merchant stores only tokens and never sees the PAN, most of its systems fall outside the scope of PCI DSS assessment. The vault operator, by contrast, must meet the full standard, undergo regular assessments as a service provider and maintain strong key management, including periodic key rotation.
Common controls include segregation of the vault network, multi-person approval for key ceremonies, strict access control for detokenisation calls, rate limits to stop bulk extraction and continuous monitoring for unusual lookup patterns. A breach of a vault would be among the most serious incidents a payment company could suffer, which is why many smaller firms choose to rely on a specialist instead of building their own. The same vault principle is used beyond cards, for example to protect bank account numbers, national identity numbers and other sensitive stored data.