Card vaulting / card-on-file credential / tokenization
Letting your payment provider hold the real card and handing you a token to charge later, so card numbers never touch your servers.
See it
What it is
Vaulting means the card number lives at your processor and you get back a token that points at it. Your database holds a customer id, a payment method id, the brand, last four, and expiry: enough to render 'Visa ending 4242' and to charge again, and useless to anyone who steals it. Because the raw number never touches your servers, you stay in the lightweight PCI questionnaire instead of a full audit, which is the real reason nobody rolls their own vault.
Reach for it the moment a customer will pay you more than once: subscriptions, top-ups, marketplaces, anything with a reorder button. The mechanics are a setup step (Stripe SetupIntent, Braintree nonce exchanged for a vault token) run in the processor's own iframe fields, so the card goes browser to processor and skips you entirely.
Two things bite. Consent: capture an explicit checkbox plus mandate text saying who charges the card, how often, and how to stop, because networks and disputes both care that the agreement exists. And lifecycle: plastic expires and gets reissued, so turn on network tokens and the account updater or a slice of your subscribers silently fail every year. Tokens are also processor-specific, so leaving a vendor means a vault-to-vault migration you have to request, not a CSV export.
Ask AI for it
Implement save-card-for-later in this checkout without any raw card data reaching my backend. Use Stripe Elements plus a SetupIntent to collect and vault the card client-side, attach the resulting PaymentMethod to a persistent Customer keyed to my user id, and store only customer id, payment method id, brand, last4, and exp month/year in my database. Add an explicit 'Save this card for future purchases' checkbox with mandate text naming who charges it, how often, and how to cancel, and record the timestamp and IP of that consent. Build a saved-cards settings list with set-as-default, detach, and an expiring soon warning, enable network tokens and card account updater so reissued cards keep working, and add a lint or log filter that guarantees no PAN or CVC ever lands in logs, analytics, or error reports.