Tokenization
Definition
Tokenization replaces a card number with a random token issued by the payment provider, so a merchant can charge a saved card later without ever storing the card itself. The real card data stays in the provider's vault, and the token is useless outside that provider. It is what makes one-click checkout and subscriptions possible without expanding PCI DSS scope.
Why it matters for your store
Returning customers are your cheapest revenue. Typing sixteen digits, an expiry date, and a CVV on a phone is the moment many of them give up. A saved card turns the second purchase into two taps.
Tokenization is how you offer that without becoming a target. If your database were breached, the attacker would find tokens that only work with your provider account, tied to your store, and nothing else. It also keeps your PCI DSS obligations at the SAQ-A level, because you never handle the card data yourself.
The same mechanism underpins subscriptions, post-purchase upsells, and refunds to the original card: all of them charge or credit a token rather than a card number.
How Kambloo handles it
When a customer chooses to save a card, the provider stores it and returns a token: iyzico's card user key and card token, or Stripe's PaymentMethod. Kambloo stores the token together with the card brand, the last four digits, and the expiry month in the store's own database. Nothing else about the card is kept.
Charging a saved card goes through the same flow as a new card. If the bank requires 3-D Secure, the customer sees the approval step and nothing more. On the order, only the card brand and last four digits are shown.
When a customer deletes a saved card from their account, Kambloo deletes the token at the provider as well, not only the local record. Deleting only locally is not allowed, so a removed card cannot be charged again by anyone.
Questions about Tokenization
Is a saved card the same as storing the card number?
No. The provider stores the card and returns a token. The store keeps the token, the card brand, and the last four digits. Even a full copy of the store database contains no usable card numbers.
Does a saved card skip 3-D Secure?
Not necessarily. If the bank or provider requires authentication for the charge, the customer still gets an SMS or app approval. The card entry step is skipped, not the security check.