Tokenization and P2PE, and why they are not the same thing.

The two problems

Card data is at risk in two different states, and they need different answers.

In transit. The number travels from the card, through your terminal or website, across your network, to the processor. Anywhere along that path it could be intercepted.

At rest. If you need to charge the same customer again — a repeat order, a subscription, a saved card — something has to be kept. Whatever is kept can be stolen.

P2PE addresses the first. Tokenization addresses the second. They are routinely described interchangeably by people selling them, and they are not interchangeable at all.

Card readEncrypted in the reader itself.

Your systemsSee a token, never a number.

In a breachVery little to lose, and a shorter SAQ.

What P2PE does

Point-to-point encryption means the card data is encrypted inside the card reader, at the moment it is read, and is not decrypted until it reaches the processor’s secure environment.

The consequence that matters: between those two points, the data is unreadable. It passes through your terminal, your network, your point-of-sale and your internet connection as ciphertext nobody in between can use — including you, and including anyone who has compromised your systems.

That is a stronger claim than “we use encryption”. Plenty of setups encrypt data in transit in the general sense while still having it readable at some point on your side. With genuine P2PE there is no such point.

It requires hardware that supports it, because the encryption happens in the reader. Most current terminals do; older ones may not, which is one of the better arguments for replacing an ageing machine.

What tokenization does

Tokenization replaces a card number with a token — a reference that means something only to the gateway that issued it and nothing to anyone else.

Your system stores the token. The real card number lives in the gateway’s vault. When you charge the customer again, you send the token and the gateway does the rest.

So if your database is stolen, the attacker gets a list of references that are worthless outside your account. There is nothing to sell and nothing to use.

This is what makes recurring billing, saved cards and one-click repeat purchases possible without you holding anything dangerous. It usually sits in your gateway, sometimes bundled and sometimes priced as a feature.

One thing to establish early: tokens are generally specific to the gateway that issued them. If you ever change provider, moving stored cards is a planned migration rather than an export — and it is the single most common thing that makes a switch painful. Ask about it before you need to know.

Why both shrink your questionnaire

PCI obligations scale with how much card data touches systems you control. That principle decides which questionnaire you answer, and it is the whole reason these technologies pay for themselves twice.

With P2PE, card data is never readable on your systems, so large parts of your environment fall out of scope.

With tokenization, you are not storing card numbers at all, so the questions about protecting stored data largely stop applying.

Together they can genuinely move a merchant from a long questionnaire to a short one, which is hours of work saved every year on top of the security benefit.

Worth one caution: scope reduction depends on the specific implementation, and “we tokenize” covers a range of arrangements. If you are relying on it to shorten your questionnaire, ask your provider to confirm it in writing rather than inferring it.

What to ask for

Five questions, and a provider who sells to merchants regularly answers all five quickly.

1. Does my terminal do P2PE, and is the encryption performed in the reader?
2. Does my gateway tokenize, and is the vault included or charged as a feature?
3. Is card data readable anywhere on my systems at any point?
4. What does this do to my SAQ — which version would I be on with and without?
5. If I change provider, what happens to my stored cards?

And one thing to do rather than ask: stop writing card numbers down. On an order form, in a CRM field, in a notebook by the till, on a slip kept for refunds. No amount of tokenization helps if the number is also on paper, and merchants frequently do not count that as storage.

What we charge

Interchange + 0.50% + 10¢ in person, interchange + 0.75% + 25¢ keyed, with no PCI fee, no monthly fee and no contract.

Tell us what hardware and gateway you run and we will tell you whether card data is genuinely out of your systems already — and if it is sitting somewhere it should not be, where that is.

While we are on the subject

Does tokenization mean I can store cards safely?

It means you store a token rather than a card number. The actual number lives in your gateway’s vault. If someone steals your database they get references that are useless outside your account.

Is P2PE the same as encryption?

All P2PE is encryption; not all encryption is P2PE. The distinction is that P2PE encrypts inside the card reader itself and decrypts only at the processor, so the data is never readable in between.

Do I need a special terminal?

For genuine P2PE, yes — the encryption happens in the reader hardware. Most current terminals support it; older ones may not.

Can I move my tokens if I change provider?

This is the question to ask before you need the answer. Tokens are usually specific to the gateway that issued them, and migrating stored cards is a planned process rather than an export.