Tokenization, vaults and PCI DSS scope reduction

Card numbers touch your servers somewhere in the flow, and every system behind that point is inside your assessment.

Symptoms in your system

Card numbers pass through your API on the way to the processor, so every service behind it is in scope.
Logs and traces captured a full card number once, and nobody can say where those files went.
Saved cards stop working the day you change processor, because the tokens belong to the processor.
Recurring billing fails after a card is reissued, and the customer has to enter it again.
Encryption keys sit in the same repository as the code that uses them, and rotation has never been run.

Card entry posts straight to the vault, so the services behind checkout hold no card data and drop out of scope.
Your assessment covers a named set of systems, and an engineer can point at the current data flow diagram that says why.
Saved cards belong to you. Changing processor becomes a routing decision, without asking every customer to enter a card again.
Recurring charges survive a reissued card, because network tokens follow the account when the plastic changes.
Refunds, chargebacks and reporting run on tokens, so a card number is never near the systems that do that work.
Keys are created, rotated and retired on a schedule you can evidence, and we prepare the environment for assessment against PCI DSS requirements.

Hosted fields added to the new checkout while an older form still posts card data, so scope comes back without anyone choosing it.
Processor tokens treated as your own vault, until changing provider means re-collecting cards from customers who have not logged in for a year.
Card data in logs, backups and support tickets, found during the assessment after the scope was agreed.
Encryption applied at the disk, so anything that can read the database can read the card numbers.
Third-party scripts loaded on the payment page, so a compromise at that vendor becomes card data leaving your checkout.

We led a US startup through its first PCI DSS Level 1 assessment in 2022, and have led the technical side of every annual assessment since.

The card vault behind it holds PAN, network and issuer tokens behind a strict API, which is what keeps the services around it outside the assessment.

Tokens rotate when the issuer reissues a card, so a saved card keeps working without the platform ever storing the number.