Skip to main content
Card numbers never touch your systems. Buyers type them into fields hosted by a PCI-compliant card vault, and your browser worker pays with a placeholder card.

​
Who sees what

​
Saving a card

  • The buyer enters the card on a Sapiom-hosted setup page. Its card fields belong to the vault, so the number goes straight there.
  • Sapiom records the buyer’s consent, with the exact terms they agreed to.
  • There’s no API for sending a card number to Sapiom.

​
Paying with a placeholder

  • A placeholder is a random card number, expiry and CVC in the card’s brand. It works for one transaction at one merchant and expires with it.
  • Browser Pay sends the checkout’s payment request to Sapiom’s relay. The relay checks the merchant, the total and the authorization. Then the vault puts the real card into the request and sends it to the processor. Sapiom’s servers never see the real number.
  • Each placeholder is relayed at most once. Without the relay, it’s just a random card number.

​
Your PCI scope

Card numbers and security codes never enter your systems. Your assessor confirms which PCI DSS requirements still apply to you.