Accept cards. Never hold them.
Capture PANs and bank data SDK-to-vault, pass tokens to processors, and keep your frontend, backend, and warehouses out of PCI scope.
Why this buyer hurts.
Scope creep
Every system that touches PAN inherits PCI DSS burden — logs, warehouses, support tools included.
Processor lock-in
Card data trapped in one gateway makes switching processors a re-compliance project.
KYC friction
Identity checks scatter PII across vendors, each copy a breach and audit liability.
Vault-native payments.
cloakit tokenizes at capture, routes vault-held data straight to processors and KYC vendors, and lets customers update details without duplicating sensitive records.
Pattern: gateway and server-side integrations, per-destination revocable grants, and refunds/chargebacks run on tokens.
The workflow, end to end.
Capture at checkout
cloakit Elements collect PAN and bank details SDK-to-vault. Your frontend never sees raw card data — SAQ scope shrinks from day one.
Route to your PSP
Vault-held data goes to your payment provider via server-to-server calls. Retries, refunds, and dunning run on references.
Reconcile on tokens
Settlement and reporting join on token references. Switching providers means re-pointing grants, not re-complying.
Asked by teams like yours.
Do we stay out of PCI scope?
Cardholder data lives only in the vault; your systems store tokens. Confirm the exact scope reduction with your QSA — that is what the vault architecture is designed to maximize.
Can we switch processors later?
Yes. Tokens are processor-agnostic references; you re-point per-destination grants instead of migrating PAN stores.
How do refunds and chargebacks work?
They run on token references resolved through the same governed path — operations keep working, raw PAN never re-enters your stack.
See it on your own workflow.
Bring one sensitive flow. We will map it to a vault schema live in 30 minutes.
From checkout to settlement, on references.
Card data is tokenized once, then auth, capture, settlement, refunds, and chargebacks all run on token references.
Elements capture"] --> V["cloakit vault
tokenize PAN"] V --> P["PSP server-to-server
auth + capture"] P --> S["Settlement + reporting
token references"] S --> R{"Refund /
chargeback?"} R -- yes --> V R -- no --> E["Done"]