Card Tokenization: What Merchants Store and What They Don't
Learn what card tokens are, gateway vs network tokens, PCI DSS SAQ A requirements, and how Cifrago charges subscriptions without touching card numbers.
Tokenization replaces a card number (PAN) with an identifier that has no intrinsic value outside the system that issued it. This allows merchants to process recurring or repeat charges without storing the actual card details. At Cifrago, card numbers are captured via hosted fields provided by the payment gateway: none of our internal components ever receive, process, or store PAN or CVC data.
Note: Cifrago is in its final development phase and is not yet onboarding new merchants. Recurring billing will be available soon.
Token vs. Card Number
| Card Number (PAN) | Token | |
|---|---|---|
| Usable outside the issuing system | Yes | No |
| In the event of a data breach | Can be used to make fraudulent purchases | Completely useless without the gateway |
| PCI DSS scope for the merchant | High | Reduced |
| Usable for recurring billing | Yes, but carries significant risk | Yes |
Network Tokens vs. Gateway Tokens
- Gateway token: Issued by the payment processor and works exclusively within their ecosystem.
- Network token: Issued by the card brand (Visa, Mastercard) and continues to work seamlessly even after the bank reissues or renews the card.
Visa tracks retry attempts by credential: token retries and PAN retries are counted separately (source: PayPal).
Regulatory Requirements
| Regulation | Key Requirement |
|---|---|
| PCI DSS v4.0.1 | The current active standard. The SAQ A self-assessment questionnaire applies to merchants that completely outsource card data entry |
| PSD2 + Delegated Regulation (EU) 2018/389 | Mandates Strong Customer Authentication (SCA) for payer-initiated electronic payments |
How Cifrago Handles Tokenization
- The customer enters their card details into fields securely hosted by the payment gateway (Paycomet JET), rather than a form hosted by Cifrago.
- The gateway tokenizes the data and returns an identifier.
- For subscriptions, the card is registered with the gateway and the subscription is established using that credential. A token generated for a one-off payment is never reused for future charges.
- The gateway credential is stored encrypted.
- When required by the issuing bank, 3D Secure (SCA) is applied.
This architecture is fully aligned with PCI DSS SAQ A.
Frequently asked questions
What is a credit card token?
It is a unique identifier that replaces the actual card number. It is only valid within the system that issued it, meaning it cannot be used anywhere else if leaked. It allows merchants to process recurring payments without having to store sensitive card details.
What is the difference between a network token and a gateway token?
A gateway token is issued by a specific payment processor and only works on their platform. A network token is issued directly by the card brand (Visa or Mastercard) and updates automatically when the bank reissues or renews the card.
Does Cifrago store credit card numbers?
No. Card numbers and CVCs are entered directly into hosted fields provided by the payment gateway. No Cifrago component ever receives, processes, or stores this data; we only store the encrypted credential returned by the gateway.
What is PCI DSS SAQ A?
It is the simplest Self-Assessment Questionnaire under PCI DSS. It applies to merchants that fully outsource cardholder data entry and processing to a certified third-party provider, ensuring no card data ever touches their own servers.
Building subscriptions?
Check the pricing and try the dashboard with sample data before integrating anything.