Card tokenisation for one-click and recurring payments

What is card tokenisation?

Card tokenisation replaces a card number with a token: a reference your systems can store and reuse, but which has no exploitable value outside the vault that issued it. When a customer saves their card, the card data goes directly into the LekkaPay vault and you receive the token. From then on, "charge this customer's saved card" is an API call with a token in it - the card number itself never appears in your databases, your logs or your backups, which is precisely why a breach of your systems cannot become a breach of your customers' cards.

A vault with no servers to steal from

Card data never touches your servers - or ours, in the traditional sense. The LekkaPay vault is serverless, built on AWS: there is no long-running vault server holding card data for an attacker to camp on, and encryption keys live in cloud HSM-backed key management rather than on any machine an administrator logs into. Data is encrypted in flight and at rest, and LekkaPay is a PCI DSS Level 1 compliant service provider - the standard's highest level, assessed annually. Security architecture is not a feature we bolted on; it is the reason the vault is shaped the way it is.

What can you build on a token?

Three things merchants ask for constantly. One-click repeat purchases: returning customers pay with a saved card in a single step, which matters most on mobile, where retyping sixteen digits kills conversion. Subscription billing: scheduled charges against stored tokens, with each outcome reported like any other payment. And card-on-file merchant-initiated transactions (MIT): charges taken while the customer is away - a top-up, a usage bill, a renewal - flagged correctly to the card schemes so issuers treat them as the legitimate agreed payments they are. All three work identically whether you process under a LekkaPay merchant account or through the gateway on your own MID.

Network tokens are live

Network tokenisation is live on LekkaPay - and it is one of the most important things on this page. Instead of holding a raw card number, the card schemes issue a network token that updates automatically when a card is reissued, replaced or expires, so saved cards and subscriptions keep working instead of failing the moment the plastic changes. We are live with Visa Token Service (VTS) and Mastercard Checkout Solutions (MCS), and we handle Mastercard's MDES behind the scenes - using network tokens wherever the schemes support them, and our own serverless vault for everything else. The payoff for merchants is direct: higher approval rates, far fewer failed renewals, and one-click payments that survive a new card landing in the customer's wallet.