OWASP Global AppSec Lisbon 2024

Handling credit and debit cards is one of the riskiest features a company can perform. However, it unlocks a lot of flexibility in the business and better serves our members. How can we implement this feature, while staying compliant with PCI and protecting this data?


We designed and implemented a tokenization service that ingests credit/debit cards and stores them in a secure manner. In this talk, we'll present an in-depth case study of building this process and deep dive into the main use cases. We'll cover the "why" this was needed, the design, implementation, and metrics. Further we'll detail how card info is ingested, stored, and shared with authorized partners and services.  We'll also share some challenges we faced along the way.

Our goal is to provide a full picture of this service and how other companies can apply these techniques to securely handle payment cards in their ecosystem.