# Vaultera

> Payments infrastructure for travel tech. PCI DSS Level 1 card tokenisation and payment orchestration from Iceland.

Vaultera is an Icelandic fintech company headquartered in Reykjavik, founded in 2018. We build payments infrastructure for software companies that handle credit card data — primarily Property Management Systems (PMS), Channel Managers, and booking engines in the travel and hospitality industry.

## Vaultera Vault — Card Tokenisation Service

**URL:** https://vaultera.co/vault
**Docs:** https://docs.vaultera.co

Vaultera Vault is a PCI DSS Level 1 certified card tokenisation service that has been in production for over 6 years, processing more than 10 million tokens per month.

### How it works

Vault operates as a reverse proxy that sits between your platform and card data sources. It intercepts API responses containing card numbers, replaces them with tokens, and stores the original card data in our PCI Level 1 certified vault. Your system only ever sees tokens — never raw card numbers.

### Key capabilities

- **Reverse proxy tokenisation**: Transparent interception of card data in API traffic. No code changes required on your platform.
- **OTA card extraction**: Automatically extracts card data from Booking.com, Expedia, and other OTA reservation payloads.
- **Card Capture JavaScript widget**: Embeddable card entry form for direct guest card capture. Card data goes straight to the vault, never touching your servers.
- **Acquirer routing**: Forward stored card data to any acquirer or PSP for payment processing. Detokenise on-demand for authorisation requests.
- **PCI scope elimination**: By offloading card storage and handling to Vaultera, your platform drops out of PCI DSS Level 1 scope entirely.

### Target audience

Property Management Systems (PMS), Channel Managers, booking engines, travel agencies, and any software platform receiving card data from OTAs like Booking.com and Expedia.

## Vaultera Switch — Payment Orchestration

**URL:** https://vaultera.co/switch
**Docs:** https://docs.switch.vaultera.co
**Status:** Generally available

Vaultera Switch is a payment orchestration platform that connects your platform to 20+ payment service providers through a single API integration.

### Key capabilities

- **Smart transaction routing**: Rule-based routing by currency, amount, geography, card type, and PSP performance metrics.
- **Automatic failover**: If a PSP is down or declines, transactions automatically retry through alternative providers.
- **20+ PSP connections**: Stripe, Adyen, Rapyd, Shift4, Bambora, Authorize.net, PayPal, IATA Pay, Checkout.com, Nets, Worldpay, Straumur, Valitor Pay, Teya, Paymentexpress, SagePay, Global Collect, 2Checkout, Paypal Payflow, First Data, and more.
- **3D Secure support**: Built-in 3DS handling across all connected PSPs.
- **Hosted checkout**: Pre-built, customisable checkout page.
- **Multi-currency**: Process payments in any currency supported by your connected PSPs.

### Target audience

Travel tech platforms, marketplaces, SaaS platforms, and any business processing payments through multiple PSPs.

## Company Information

- **Founded:** 2018
- **Headquarters:** Reykjavik, Iceland
- **Certifications:** PCI DSS Level 1 (annual audit by independent QSA)
- **Contact:** hello@vaultera.co
- **Website:** https://vaultera.co

## Key Topics

Vaultera regularly publishes content about:
- PCI DSS compliance for software companies
- Credit card tokenisation technology
- Payment orchestration and smart routing
- Travel tech payment infrastructure
- Booking.com and Expedia PCI compliance requirements
- PCI scope reduction strategies for PMS and Channel Managers

## Blog Posts

- [Card-on-File for Hotels: From Booking to Checkout Without Touching Card Data](https://vaultera.co/blog/card-on-file-for-hotels): Hotels need card-on-file for pre-auths, incidentals, and checkout — but storing real card numbers creates massive PCI liability. Here's how tokenisation solves the entire guest payment journey.
- [Encryption vs Tokenisation: Which One Actually Protects Your Business?](https://vaultera.co/blog/encryption-vs-tokenisation): Encryption hides card data. Tokenisation removes it from your systems entirely. Learn the critical difference — and which approach actually reduces your PCI burden.
- [How Channel Managers Should Handle Card Data](https://vaultera.co/blog/how-channel-managers-handle-card-data): Channel managers receive card data from OTAs and pass it downstream — putting them squarely in PCI scope. Learn why tokenisation at the channel manager level is the solution.
- [How to Dramatically Reduce PCI Scope — And Why It Matters](https://vaultera.co/blog/how-to-reduce-pci-scope): Three strategies to get card data out of your environment: hosted pages, iframes, and full tokenisation. Why tokenisation wins for travel tech companies.
- [How Vaultera Switch Works: One API, 20+ PSPs](https://vaultera.co/blog/how-vaultera-switch-works): Vaultera Switch routes transactions across 20+ PSPs through a single API. Learn how the architecture works — from smart routing and failover to unified reporting.
- [How Vaultera Vault Dramatically Reduces Your PCI Footprint — Without Changing Your Workflow](https://vaultera.co/blog/how-vaultera-vault-reduces-pci-scope): See how Vaultera Vault uses tokenisation to remove card data from your systems, dramatically reducing your PCI compliance burden without rewriting your payment workflow.
- [Network Tokens vs Vault Tokens: What's the Difference?](https://vaultera.co/blog/network-tokens-vs-vault-tokens): Network tokens and vault tokens serve different purposes in payment infrastructure. Learn how each works, when to use them, and why advanced systems combine both.
- [PCI Compliance for Property Management Systems: What You Need to Know](https://vaultera.co/blog/pci-compliance-for-pms): Most PMS companies don't realise how deep their PCI exposure runs. Learn where card data lives in your system and how tokenisation at the point of entry changes everything.
- [PCI DSS 4.0: What Changed and Why You Should Care](https://vaultera.co/blog/pci-dss-4-changes): PCI DSS 4.0 introduced 64 new requirements, 51 of which became mandatory March 31, 2025. Here's what changed and what it means for travel tech companies.
- [PCI SAQ Types Explained: A, A-EP, D — Which One Are You Stuck With?](https://vaultera.co/blog/pci-saq-types-explained): SAQ A, A-EP, and D determine your PCI compliance burden. Learn what each type means, which one applies to your business, and how tokenisation can move you to a lighter category.
- [The Real Cost of PCI Compliance — And How to Avoid Most of It](https://vaultera.co/blog/real-cost-of-pci-compliance): PCI DSS compliance can cost mid-market travel tech companies six figures a year. Here's an illustrative cost breakdown and the business case for tokenisation.
- [Why Smart PSP Routing Improves Approval Rates and Cuts Costs](https://vaultera.co/blog/smart-psp-routing-approval-rates): Routing all transactions through a single PSP leaves revenue on the table. Learn how smart PSP routing improves approval rates and reduces processing costs.
- [What Is Payment Orchestration? A Simple Guide for Growing Businesses](https://vaultera.co/blog/what-is-payment-orchestration): Payment orchestration connects your business to multiple PSPs through one API — enabling smart routing, failover, and cost optimisation. Learn how it works and why growing businesses need it.
- [What Is Tokenisation? The Casino Chip Explanation](https://vaultera.co/blog/what-is-tokenisation): Tokenisation swaps sensitive card data for a meaningless token. Learn how it works using the casino chip analogy — and why it matters for PCI compliance.
- [Why Hospitality Remains a High-Value Target for Payment Data Attacks](https://vaultera.co/blog/why-hotels-targeted-card-breaches): Hotels store cards longer, operate fragmented tech stacks, and face high staff turnover — making hospitality one of the most targeted sectors for card data breaches.

## Links

- [About](https://vaultera.co/about)
- [Integrations](https://vaultera.co/integrations)
- [Compliance / AoC](https://vaultera.co/compliance)
- [Blog](https://vaultera.co/blog)
- [Contact](https://vaultera.co/contact)
- [Vault Pricing](https://vaultera.co/vault/pricing)
- [Switch Pricing](https://vaultera.co/switch/pricing)
- [RSS Feed](https://vaultera.co/feed.xml)