PCI-compliant payment data vault: how EPD Commerce protects card data
Raw card data is a liability. Every system that touches it, stores it, or transmits it inherits a compliance burden that costs time, money, and risk exposure. The EPD Commerce Payment Vault solves this at the point of capture: card data is encrypted before it ever reaches EPD Commerce systems, and transactions route to your processor through a secure intermediary.
What the EPD Commerce Payment Vault does
The EPD Commerce Payment Vault is the card data security and compliance layer of EPD Commerce. It captures and encrypts credit card data outside of EPD Commerce systems entirely, so no raw card numbers are stored on our servers at any point.
Here is how the flow works:
- A customer enters card details at checkout.
- Card data is captured and encrypted at the point of entry, before it reaches EPD Commerce.
- A secure token replaces the raw card number in all downstream systems.
- Transactions route through the vault to your connected processor.
- Transaction data is reported back to EPD Commerce for analytics and reconciliation, without raw card data in the payload.
The result: your customers’ card data lives in an encrypted vault, your systems never handle raw PANs, and your PCI compliance posture reflects that reality.
What this means for PCI compliance
PCI DSS scope is largely determined by whether raw card data touches your systems. When card capture and encryption happen outside EPD Commerce, and tokens replace card numbers before any data reaches our infrastructure, the scope of your compliance review shrinks considerably.
EPD Commerce maintains this posture by design:
- No raw card data is stored in EPD Commerce systems at any stage.
- Encryption happens at capture, before the data enters the transaction flow.
- All processor connections are proxied through the vault, so the encrypted path applies regardless of which backend processor handles the transaction.
This is not a configuration option. It is how the platform works for every merchant.
Card auto-updater
One practical benefit of centralized vault storage: when a customer’s card is reissued, the vault can update the stored token automatically. This matters most for subscription merchants, where a card update that does not propagate means a failed renewal and a manual recovery effort.
Card auto-update is available for vault-stored cards. Auto-update behavior depends on processor support and is configured accordingly.
What does not change
Merchants already processing through EPD Commerce continue to operate normally. The vault introduces a new path for Easy Pay Direct and Authorize.net-connected accounts, but it does not disrupt live integrations.
Transaction reporting flows to EPD Commerce’s analytics layer regardless of which processor handles the transaction, so your Analyze dashboard reflects a complete picture of volume without double-counting.
FAQ
What is the EPD Commerce Payment Vault?
The EPD Commerce Payment Vault is the card data encryption and storage system within EPD Commerce. It captures and encrypts credit card data at the point of entry so that raw card numbers never touch EPD Commerce servers. Transactions route from the vault to your connected processor using a secure token in place of the raw card number.
Does using the vault make my business PCI compliant automatically?
The vault significantly reduces your PCI scope by ensuring raw card data never enters EPD Commerce systems. No raw PANs are stored or transmitted through EPD Commerce infrastructure. Your specific compliance posture depends on how your own systems handle card data outside of EPD Commerce, but the platform’s handling of card capture is designed to keep raw data out of scope.
Which processors work with the EPD Commerce Payment Vault?
The vault currently supports Easy Pay Direct merchant accounts and Authorize.net as backend processors. Existing integrations continue to operate through a proxied connection within the vault.
Does the vault affect how transactions are reported in my EPD Commerce dashboard?
No. Transaction data is sent to EPD Commerce for reporting and reconciliation regardless of which processor handles the transaction. The analytics layer receives a complete transaction record, without raw card data, so your reporting is not fragmented by processor choice.
What happens to my existing integration if I am already processing through EPD Commerce?
Existing merchant integrations continue operating without interruption. The vault introduces a new path for Easy Pay Direct and Authorize.net-connected merchants, but it does not alter live integrations. Both paths report into the same transaction reporting layer.
EPD Commerce is currently in Beta, with public launch in October. To learn more or request access, visit epd.com.