The short answer
Tokenisation replaces a card number with a meaningless reference stored by your gateway or processor. You can charge the customer again using the token, but the token is worthless if stolen. It is the single most effective way to reduce both breach exposure and PCI scope.
Gateway tokens versus network tokens
Gateway tokens work within one provider. Network tokens, issued by Visa and Mastercard, update automatically when cards are reissued and travel better between providers. Prefer network tokens where available.
Portability is the catch
Tokens are typically provider-specific. Agree in writing, before integrating, that your vault can be migrated on request — otherwise the stored cards become the reason you cannot leave.
Key takeaways
- Tokens remove card data from your systems entirely
- Network tokens self-update on card reissue
- Negotiate vault portability before integration
Want this checked against your own statement?
We are an independent agent — we shop every processor we work with and bring you the best deal for your profile. Free analysis, every fee named, back within 4 hours. Or call now and we will quote you on the phone.