Where is the card actually stored?

In our PCI-scoped vault, as a network token. Your systems store a reference to it, which is useless anywhere else.

Does a saved card survive the customer getting a new one?

Yes. Network tokens follow the cardholder through reissues and expiries, so a saved card keeps working when the plastic changes.

Does a one-click payment still need authentication?

Usually not a challenge — the initial payment carries the authentication, and subsequent charges run under the exemptions the rules allow. Where a step-up is required, it appears in the flow.

Can a customer remove a saved card?

Yes, and the token is deleted with it. Any subscription running against that token needs a new card, and you're notified rather than finding out at the next failed charge.

/// Method · Cards

The second purchase should be shorter than the first.

A saved card turns checkout from a form into a tap. The card itself is vaulted on our side and referenced by token, so your systems never store a card number — which is what makes one-click checkout a configuration decision rather than a compliance project.

See Protocore Gateway All payment methods

1 tap

For a returning customer

Token

What your systems store

Network

Survives reissues

Card numbers held by you

/// How it runs

First purchase to one-click, four steps.

[ 01 ]
PAY
The customer pays normally on the first purchase and opts to save the card.
[ 02 ]
VAULT
The card is stored on our side as a network token; you receive a reference.
[ 03 ]
RETURN
On the next order the saved card is offered — one tap, no form.
[ 04 ]
CHARGE
The payment runs against the token, producing the same order and receipt as any card.

/// 01

What the customer sees

Their card, already there, shown by scheme and last four digits — and a pay button rather than a form. For repeat businesses this is the single largest conversion difference between a first and second purchase, because the friction that made them hesitate the first time simply isn't present.

[ 01 ]Card shown by scheme and last four, not re-entered
[ 02 ]One tap instead of a form on every return visit
[ 03 ]Multiple saved cards, with one set as default

/// 02

Why your systems never hold the card

The vault is on our side, and what you receive is a token that only means anything against your account. Your database can be read by anyone in your team and there is still no card number in it — which is the difference between one-click checkout as a feature and one-click checkout as a liability.

[ 01 ]Tokens in your systems, cards in our PCI-scoped vault
[ 02 ]Nothing to protect, rotate, or explain in an assessment
[ 03 ]The same token drives subscriptions and one-off repeat purchases

/// 03

What it takes to switch on

A flag on the payment that says to vault the card, and a place in your UI to offer it back. The token is then usable for one-click purchases, subscriptions, or both.

/// FAQ

Saved cards — questions merchants ask.

In our PCI-scoped vault, as a network token. Your systems store a reference to it, which is useless anywhere else.
Yes. Network tokens follow the cardholder through reissues and expiries, so a saved card keeps working when the plastic changes.
Usually not a challenge — the initial payment carries the authentication, and subsequent charges run under the exemptions the rules allow. Where a step-up is required, it appears in the flow.
Yes, and the token is deleted with it. Any subscription running against that token needs a new card, and you're notified rather than finding out at the next failed charge.