Transferring credit card details to hotels without PCI

Question

I'm developing a web application for hotels that send offers to the guest's hotels. I want to store the guest's credit card data in a secure way, through a third party service as I don't want to implement a PCI DSS compliant solution myself.

I don't want (and I cannot) process the payments, as each hotel has its own payment gateway and it will process the payments later on. However we should give to each hotel the capability of accessing credit card data upon offer acceptance by guests. Hotels must perform antifraud check (like 1$ transaction) or introduce the cc data in their payment software system.

I would like to understand how this workflow could be achieved: most of the online services offer "tokenization" as a storage solution.

Which seems good, but I don't know how the send the card information to the hotels. It seems to me that tokenization is used to perform later the transaction, which I cannot do on behalf of the hotels. Moreover, once tokenized, it seems to me that data cannot be recovered. Each hotel must be able to actually see and use the cc data of its guests.

Any help and/or reference to a suitable provider is welcome.

Answer 1

I want to store the guest's credit card data in a secure way, through a third party service as I don't want to implement a PCI DSS compliant solution myself

Sorry, you still need to be PCI-compliant. Read the following:

Q2: To whom does the PCI DSS apply?

A: The PCI DSS applies to ANY organization, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data.

Source: To Whom does PCI DSS apply?

That being said, you may qualify for one of the less restrictive levels of PCI-DSS. To find out, check this link: Which SAQ is appropriate for me?

Also, depending on the hotel, you may need a lot more than just the credit card number. Typically they will also submit name, address, expiration, and CVV in order to validate the transaction. If they require CVV, you have a serious problem: you cannot store CVV in any form for any purpose.

Here is a good reference to get you started on your own compliance: ComplianceGuide.org.