Tokenization

The card number is stored by the provider or the card network, while the merchant receives and keeps only the token. It can be used for repeat and recurring charges without storing card details on the merchant's side.

This narrows the merchant's PCI DSS scope: if card numbers never pass through its servers, there is far less to audit and protect. A leak of tokens does not expose the cards themselves.

Tokens can be provider tokens (valid with one PSP only) or network tokens issued by the card networks. A network token usually keeps working after the card is reissued, while provider tokens make it harder to switch providers — worth asking about up front.

Local payment methods for online businesses →