Card Vaulting

Introduction

As part of our Payment Optimization suite, Forter offers agnostic card vaulting solutions that work across all processors to:

• Protect sensitive card data by replacing it with secure tokens.
• Improve payment performance by reducing fraud and increasing approval rates.
• Maintain full control over card data while ensuring compliance with PCI-DSS standards.

Our suite includes:

• PCI Tokens
• Network Tokens
• Account Updater

These solutions help you optimize your payment stack while tailoring your compliance needs to your business model.

Benefits of Forter Tokenization

• Agnostic Tokens – Enabling multi-processor strategy.
• Zero PCI Scope – Eliminate the need to build and maintain a PCI-certified vault, saving resources, costs, and compliance efforts.
• Processor Flexibility – Tokenized card data can be used across multiple payment processors.
• Enhanced Security – Protect sensitive card data, reducing the risk of fraud and data breaches.
• Seamless Integration – Work with any processor, ensuring full payment ecosystem flexibility.

Choosing the Right Tokenization Approach

When implementing Forter Tokenization solution for your project, select only one of the available approaches outlined in this documentation.

Zero PCI Scope** (Recommended)**

Who is it for? Merchants who want to avoid handling card data entirely
Compliance scope: Forter fully handles compliance
**How it works:**Forter collects and tokenizes card data before it reaches your system

1. Implement Forter’s Hosted Fields on your checkout page.
2. Receive a single-use token when the customer submits payment.
3. Process transaction using the token.
4. Upgrade to a multi-use token for recurring payments via the Upgrade API.

Limited PCI Scope

Who is it for? PSPs & merchants who are already PCI compliant but want to reduce scope
Compliance scope: You retain some compliance responsibilities
**How it works:**You collect card data but tokenize it through Forter's API

1. Collect card data in your front end (checkout window), but send to Forter to receive a PCI token before storing in backend.
2. Forter passes card data via Detokenization Proxy to processor(s) when needed (i.e., in Authorization step).

Which one to choose?

If you don't want any PCI liability, choose Zero PCI Compliance.
If you already have PCI compliance but want to minimize exposure, choose Limited PCI Compliance.

Components

Zero PCI Compliance

Forter handles the entire process, so you never touch raw card data.

Detokenization Proxy
Passes card data to third-party services without exposing raw card details.

Hosted Fields Collects card data securely on the checkout page and returns a token.

Limited PCI Compliance

You collect card data but reduce PCI scope with Forter’s Tokenization API.

PCI Tokenization Replace sensitive payment data with non-sensitive tokens.

Additional Payment Optimization Features

In addition to PCI Tokenization, Forter's Card Vaulting solution also offers:

Network Tokenization Reduce processing costs & improve approval rates using network-issued tokens.

Account Updater Automatically update expired or replaced cards for seamless transactions.