I often see the phrase “Secure Vault” in PCI DSS documentations and I want to know if a “Secure Vault” must be a highly protected file with sophisticated technologies stored on a very secure hardware or simply it can be a database behind multiple layers of standard security mechanisms.

I mean if we want a high level of scalability could it be a database? Is there any standard for designing and implementing a “Secure Vault”? What are best practices for design and implementation?

Unfortunately I couldn’t find any handy documentation other than commercial datasheets of available products.

Any help appreciated.

  • 1
    The phrase 'vault' doesn't show up in the DSS itself. Can you link to some of the documents you're describing?
    – gowenfawr
    Dec 17, 2014 at 11:51
  • PCI Data Security Standard (PCI DSS) Version: 2.0 Date: August 2011 Author: Scoping SIG, Tokenization Taskforce PCI Security Standards Council Information Supplement: PCI DSS Tokenization Guidelines
    – anonim
    Dec 17, 2014 at 13:35

1 Answer 1


"Secure Vault" is being used here in the context of tokenization, which almost always means "the Vault that someone else (e.g., your payment processor) keeps the cards in, and you only ever deal with the tokens that correspond to items in the vault."

You can, of course, implement a "vault" yourself - that means a data store for PAN data which meets all the criterion of the PCI DSS such as encryption, authentication, access control, logging, etc. etc. Read the DSS, implement what it says, and do it well enough to pass an audit - voila, you're done!

But, again, "vault" is used to identify the data store backing tokens. If you're storing cards in your vault right next to the system where you're storing and using the tokens, you haven't gained anything; you still have to do all the work of protecting the PAN data. If you're not using tokens, it's not a vault, it's just a database with PAN data in PCI scope and subject to the DSS.

The purpose of tokenization is to limit the burden of the DSS. If your processor stores the PAN data, and only gives you the tokens, then you do not need to store and maintain them to the same level of compliance that you would have to if you stored the PAN data. "Vault" is just a term that describes this separation between the sensitive storage tier and the end-user (you, the merchant) tier (that is, the tokens).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .