Payments glossary
Tokenisation
Tokenisation replaces a card number with a unique, non-sensitive token that is useless if stolen. Merchants store and reuse the token for repeat and recurring payments while the real card details stay in a secure, PCI DSS-compliant vault.
How tokenisation works
At the moment card details are captured, they are exchanged for a token - a unique reference with no exploitable relationship to the card number. The real card data goes into a hardened, PCI DSS-compliant vault; the merchant's systems store and use only the token. Charging the customer again means submitting the token, which the vault resolves back to the card entirely inside the secure environment. The card number never touches the merchant's databases, logs or backups.
What tokenisation changes for merchants
Two things: risk and revenue. Risk, because a breached database of tokens is worthless to an attacker - the blast radius of an incident shrinks dramatically, and with it the merchant's PCI DSS scope. Revenue, because stored credentials are the engine of modern commerce: one-click checkout for returning customers, subscriptions that renew without friction, instalments and top-ups that run on schedule. Tokenisation is the security measure that happens to be a growth feature.
Tokenisation on LekkaPay
LekkaPay's tokenisation is live and built into the gateway: cards are tokenised at first payment and reusable for card-on-file and recurring billing, with the vault and its PCI DSS obligations carried by the platform rather than the merchant.
Frequently asked questions
Does tokenisation make my business PCI DSS compliant?
It removes most of the burden rather than all of it. When card details are tokenised at the point of capture and stored in the provider's vault, your systems never hold real card numbers, which shrinks your PCI DSS scope to a much simpler self-assessment. The provider carries the heavy compliance load.
How is a token different from encryption?
Encrypted card data can be decrypted by anyone who obtains the key. A token has no mathematical relationship to the card number at all - it is a reference to a record in a secured vault - so a stolen token is useless outside the system that issued it.
Can I use tokens for recurring billing?
Yes - that is their main commercial job. A customer's card is tokenised on the first payment, and subsequent subscription charges, instalments or top-ups are made against the token as merchant-initiated transactions, without the customer re-entering their card.
Last updated:
Payments without the jargon.
One integration, every way Africa pays - we'll handle the acronyms.