Comparing the best tokenization software for travel agencies of 2026: 1. Enigma Vault, 2. PCI Booking, 3. VGS, 4. PCI Proxy, 5. Spreedly, 6. IXOPAY, and 7. Basis Theory.
About the author: I’m Dr. Tony Alex, Chief Executive Officer of Enigma Vault, where I lead our work in encryption, tokenization, and sensitive-data protection. I have more than two decades of experience building enterprise software businesses.
In 1999 I founded US eDirect to develop software for parks, campgrounds, and recreation agencies, bringing reservations and payments into one cloud system, and led it through its acquisition by Tyler Technologies in 2022.
Disclosure: Enigma Vault publishes this guide and appears first in it. Every platform here is judged on the same criteria, and the review ratings come from G2 and Capterra.
Tokenization software for travel agencies replaces a traveler’s card number and passport details with tokens that your GDS, mid-office, and advisors can store and use, while the real values stay in a separate vault. It protects cards from the phone desk and booking link through the PNR, the supplier payment, and the invoice.
The best options in 2026 are Enigma Vault for agency desks that take cards by phone, link, and web; PCI Booking and Spreedly for platforms passing cards to many suppliers; VGS for OTAs filling supplier web pages; PCI Proxy for airline and travel sellers; IXOPAY for high-volume sellers routing across acquirers; and Basis Theory for OTAs routing cards to GDS partners and suppliers.
To choose, list where traveler cards reach your agency in a normal week, then pick the platform that covers your riskiest channel and pays suppliers the way you already do.
TL;DR
- Enigma Vault: best for agency desks running web, phone, supplier, and AI steps in one vault.
- PCI Booking: best for platforms passing cards between OTAs, GDSs, and suppliers.
- VGS: best for OTAs automating supplier portals without becoming merchant of record.
- PCI Proxy: best for airline and travel sellers building a composable stack.
- Spreedly: best for booking through many supplier APIs from one stored card.
- IXOPAY: best for high-volume travel sellers routing across many acquirers.
- Basis Theory: best for OTAs routing card data to GDS partners and suppliers.
Best Tokenization Software for Travel Agencies at a Glance
Here is how the seven platforms compare for an agency that takes cards by phone and link, then pays airlines, hotels, and cruise lines on the traveler’s behalf. Prices and ratings were checked on November 13, 2026.
| Platform | Best for | Starting price | Free tier or trial | Phone and link capture | Sends cards to suppliers | G2 rating |
|---|---|---|---|---|---|---|
| Enigma Vault | Agency desks taking cards by phone and link | $49/mo per product | Free Lite sandbox | Twilio Pay IVR; secure intake links | Logged reveals; gateway proxy | 4.4/5 (6 reviews) |
| PCI Booking | Platforms passing cards between OTAs and GDSs | Not published (per card operation) | Free sandbox | Card link by email or SMS | Send, show, or charge; virtual cards | No listing |
| VGS | OTAs automating supplier web portals | $1,000/mo (Starter Package) | Free to start | Not published | API forwarding; browser proxy | 4.7/5 (47 reviews) |
| PCI Proxy | Airline sellers building a composable stack | €350/mo plus usage | Free trial | Tokenization Link | Forwarding, Show, and SFTP batch | No reviews yet |
| Spreedly | Booking many supplier APIs from one card | $750/mo (Independent Vault) | Not published | Not published | HTTPS and SFTP receivers | 4.4/5 (35 reviews) |
| IXOPAY | High-volume sellers routing across acquirers | Not published | Sandbox on request | Not published | Not published | 4.6/5 (17 reviews) |
| Basis Theory | OTAs routing cards to GDSs and suppliers | $995/mo (20,000 tokens) | Free to start | Not published | Routes to GDSs, hotels, airlines | No reviews yet |
Get client cards out of your agency inbox
Show us how a booking reaches your desk, and we will map the card from first call to supplier payment.
How We Ranked Tokenization Software for Travel Agencies
| Criterion | Weight | What we checked |
|---|---|---|
| Supplier hand-off | 25% | Stored card to GDS, supplier API, portal, or agent, logged |
| Capture across channels | 20% | Web forms, phone and IVR, secure links, partner files |
| Merchant-of-record flexibility | 15% | Charging through the agency’s gateway and passing cards on |
| Traveler documents and AI | 15% | Passports, IDs, and AI assistant prompts |
| Fit for agency teams | 10% | Usable without a large engineering team |
| Price transparency | 10% | Published plans, free sandboxes or trials |
| Reviews | 5% | G2 and Capterra ratings and comments |
Vendor facts come from each vendor’s own pages, checked on November 13, 2026. Payment gateways such as Stripe, Adyen, Braintree, PayPal, and Authorize.net are partners these platforms charge through, so they are not ranked. Where a page is silent, we write “Not published.”
The 7 Best Tokenization Platforms for Travel Agencies
1. Enigma Vault: Best for Agency Desks Running Web, Phone, Supplier, and AI Steps in One Vault
- Phone capture
- Twilio Pay IVR into Card Vault (Growth and Business); secure card links
- Starting price
- Free Lite sandbox, then $49 a month per product
- Supplier hand-off
- Gateway proxy; logged reveals in Customer Vault
- Who it suits
- Leisure agencies, TMCs, and tour operators whose advisors take cards and passports by phone and email, then book suppliers that cannot all be reached by API.
Enigma Vault is a vaulted tokenization platform delivered as APIs, a payment proxy, and a no-code intake app. Your booking systems hold tokens, and the real card and passport values stay in the vault under per-customer keys.
Scenario: One Booking, Three Suppliers
A traveler phones in a flight, hotel, and tour. The card goes into Card Vault through Twilio Pay without reaching the advisor’s screen, and the agency-charged deposit runs through your own gateway via the proxy.
When a supplier charges, an authorized advisor reveals the card in Customer Vault for its portal, with every reveal logged.
Key Features
- Card Vault tokenizes cards from web forms, phone calls through Twilio Pay, and APIs.
- Customer Vault gives advisors a branded intake link for cards, passports, and signed forms with no integration work.
- Customer Vault also tokenizes passport numbers and dates of birth.
- The proxy reaches Stripe, Authorize.net, Braintree, PayPal, or any REST gateway.
- For years of cards on file, Agent Vault is an eight-week migration engagement.
Pricing: Starter, Growth, and Business run $49 to $499 a month per product, with Twilio Pay phone capture from Growth; Customer Vault is priced by engagement.
Pros
- Covers the human steps: Phone capture, secure links, and logged reveals fit suppliers that still need a person at a keyboard.
- Gateway stays yours: The proxy works with the merchant account you already have.
- Start without a contract: Published prices and a free sandbox let a small agency test one booking flow first.
Cons
- No GDS connector: Native Sabre, Amadeus, or Travelport connectors and direct supplier API forwarding are not published, so card entry into a PNR still happens through an advisor or your own integration.
- ISO 27001 still in progress: PCI DSS Level 1 and SOC 2 Type II are in place; some corporate travel RFPs ask for ISO 27001 today.
What Users Say
Very positive, from a small sample: 4.4/5 from 6 reviews on G2 and 4.8/5 from 4 on Capterra. One G2 reviewer calls the API “simplistic and easy to understand,” while one wants more flexible reporting dashboards and one finds pricing a bit high.
2. PCI Booking: Best for Platforms Passing Cards Between OTAs, GDSs, and Suppliers
- Phone capture
- Card by link over email or SMS
- Starting price
- Per card operation; free sandbox
- Supplier hand-off
- Send, show, or charge; virtual cards
- Who it suits
- TMCs, tour operators, bed banks, wholesalers, and OTAs with developers, whose cards arrive from partner systems and must reach hotels and suppliers in each partner’s format.
PCI Booking, based in Dublin, calls itself the card-flow hub for travel. Its homepage organizes everything as cards in, cards stored, and cards out, and names TMCs, tour operators, bed banks, and wholesalers among the platforms it is built for.
Scenario: One Booking, Three Suppliers
A booking arrives from an OTA or GDS through a prebuilt profile and becomes one token holding the number, CVV, expiry, and 3D Secure result.
PCI Booking can then charge it through 120+ payment integrations, send it to each hotel or supplier in the format it expects, or show it to staff through a one-time link protected by a one-time password.
Key Features
- Prebuilt profiles cover the major OTAs, channel managers, and GDSs.
- SFTP files are tokenized on arrival.
- Virtual cards can be issued through your own provider.
- A card link goes to the traveler by email or SMS.
- Its security page lists PCI DSS Level 1 against v4.0.1, valid to December 8, 2026, and ISO 27001:2022.
Pricing: Per card operation, with tokenization from a few cents, volume discounts, and a free sandbox while you are a customer; the model is built for high-volume technology providers, so ask for a quote based on your volume.
Pros
- Travel-native flows: GDS and OTA profiles mean partners change nothing on their side.
- Virtual cards included: Issued cards follow the same path as traveler cards.
- Evidence published: PCI and ISO certificate dates are on its security page.
Cons
- API-first: Going live means integrating your payment pages and partner connections.
- Cards only: Passport protection is not published, so passports and traveler PII need a second vendor.
What Users Say
We found no PCI Booking listing on G2 or Capterra, so there are no public ratings to report; ask for references in your segment and test one inbound GDS profile and one supplier hand-off in the sandbox.
3. VGS: Best for OTAs Automating Supplier Portals Without Becoming MoR
- Phone capture
- Not published on the OTA page
- Starting price
- Plans from $1,000 a month; free to start
- Supplier hand-off
- API forwarding or browser proxy into supplier pages
- Who it suits
- Online agencies and booking platforms with engineers, acting as intermediary sellers, that want to own traveler card data and send it to several suppliers and their PSPs.
VGS is a token vault with a dedicated page for OTAs and other agent platforms. It describes the “double-loop” payment, where each booking is paid from traveler to agency and again from agency to the hotel or airline.
Scenario: One Booking, Three Suppliers
The traveler pays the agency, and the agency pays each hotel or airline. A stored card goes to each supplier’s PSP by API forwarding, or a headless browser and forward proxy fill a supplier’s web page from the vault.
If one provider cannot fulfill, the card can go to an alternate provider.
Key Features
- API forwarding sends a stored card to each supplier’s PSP.
- A headless browser and forward proxy fill supplier web pages from the vault.
- Its OTA page explains how an agency can keep card data without becoming merchant of record and move to the merchant model later.
- The Growth Package adds network tokens, account updater, and a PCI Compliance Subscription.
Pricing: Free to try, with the Starter Package from $1,000 a month and a custom Growth Package.
Pros
- Supplier portal automation: The browser proxy addresses suppliers that only take cards on a web page.
- MoR guidance: Its OTA page explains both agency and merchant models.
- Largest review base here: 47 G2 reviews describe running it in production.
Cons
- Highest published entry price: $1,000 a month is a large step for a small agency.
- Engineering required: Portal automation is a build, with no advisor screen out of the box; GDS connectors, phone capture, and virtual-card issuing are not published on its OTA page.
What Users Say
Very positive, with 4.7/5 from 47 reviews on G2; its Capterra listing has no reviews. G2’s summary highlights easy integration and responsive support, while some users find the documentation hard to navigate and one says VGS is still far from a full orchestration layer.
4. PCI Proxy: Best for Airline and Travel Sellers Building a Composable Stack
- Phone capture
- Tokenization Link; no phone flow published
- Starting price
- €350 a month plus usage; free trial
- Supplier hand-off
- Forward to partners; SFTP batch both ways
- Who it suits
- Airlines, consolidators, and larger travel sellers that want to own their card credentials and pick vault, 3D Secure, and gateway components separately.
PCI Proxy, powered by Planet, sells a composable card payment stack. Airlines and travel are the first two markets on its homepage, which says payment credentials pass through more hands in travel than almost any other industry.
Scenario: One Booking, Three Suppliers
For the part the agency charges, its gateway orchestrates payments across 25+ card acquirers, and 3D Secure runs once and travels to any PSP.
For supplier-charged parts, forwarding sends the plain card to a partner, and Show displays plain card details in a PCI DSS compliant way.
Key Features
- A gateway orchestrates payments across 25+ card acquirers.
- 3D Secure runs once, and the result travels to any PSP.
- Partners can exchange cards by SFTP batch in both directions.
- Airlines are a named market, with an airline-solutions customer quote on its homepage.
Pricing: €350 a month plus usage for one brand, or €650 for multiple brands, with a free trial, no setup fees, and no long-term contracts.
Pros
- Airline focus: Airlines are a named market on its homepage.
- Portable tokens: Its homepage stresses that tokens and credentials stay yours to move.
- Published prices: Two tiers with a free trial.
Cons
- Usage fees on top: Usage rates are not published, so agencies need an estimate to budget.
- Developer product: No advisor phone flow is published, and GDS profiles are not published either.
What Users Say
No reviews yet on G2 or Capterra, so use the free trial to test forwarding to one supplier endpoint.
5. Spreedly: Best for Booking Through Many Supplier APIs From One Stored Card
- Phone capture
- Not published
- Starting price
- From $750 a month
- Supplier hand-off
- HTTPS and SFTP receivers
- Who it suits
- Travel platforms and OTAs with engineers that store a card once and later buy flights, hotels, and extras from separate suppliers by API.
Spreedly is an independent card vault with payment orchestration. Its Payment Method Distribution docs use a travel service as the example: store the traveler’s card once, then buy airline and hotel reservations on their behalf later.
Scenario: One Booking, Three Suppliers
Each supplier with an HTTPS API gets one card per call in a request template you define, and files can go to SFTP endpoints. Each receiver domain is approved with Spreedly first.
Key Features
- HTTPS receivers send one card per call in a request template you define.
- SFTP receivers deliver card files to supplier endpoints.
- The gateway side covers agency-charged payments across many processors.
- The Independent Vault includes unlimited card storage.
Pricing: The Independent Vault starts at $750 a month, and Performance Optimization, which includes PSP-agnostic routing, is quoted by sales.
Pros
- Travel is the documented example: The receiver docs describe the flight-and-hotel pattern.
- Unlimited storage: A growing repeat-traveler file does not raise the vault fee.
- Many processors: Capterra reviewers value switching and splitting across gateways.
Cons
- Integration effort: One Capterra reviewer calls it one of the hardest integrations they built.
- No advisor workflow: Suppliers that only take cards in a web portal, phone capture, and passport data are outside the documented flows.
What Users Say
Positive, with 4.4/5 from 35 reviews on G2 and 4.5/5 from 13 on Capterra. Capterra reviewers praise responsive service; one cites weak reporting and payment search, and another says testing costs money.
6. IXOPAY: Best for High-Volume Travel Sellers Routing Across Many Acquirers
- Phone capture
- Not published on the travel page
- Starting price
- Custom quote; sandbox access on request
- Supplier hand-off
- Gateway routing; supplier forwarding not published
- Who it suits
- Large OTAs, travel payment providers, and multi-brand groups acting as merchant of record across currencies and acquirers.
IXOPAY, which merged with TokenEx in 2024, combines universal tokens with a payment orchestration platform. Its travel and hospitality page focuses on multiple currencies and methods, fraud, and authorization rates when bookings change at the last minute.
Scenario: One Booking, Three Suppliers
IXOPAY fits the agency charging the whole trip: an iframe tokenizes the card before it reaches your systems, and orchestration routes payments across acquirers and currencies.
Handing the card to suppliers that charge it themselves is not published on the travel pages we checked.
Key Features
- An iframe tokenizes the card before it reaches your systems.
- Orchestration routes payments across acquirers and currencies.
- Batch tokenization moves existing cards in without asking travelers to re-enter them.
- Network tokens, account updater, BIN lookup, and point-to-point encryption cover the card lifecycle.
Pricing: Custom quote only, with sandbox access on request.
Pros
- Travel proof: In its case study, Trust My Travel moved close to 150,000 cards in by batch tokenization and reports about 22 million transactions over roughly three years.
- Card-on-file migration: Batch tokenization avoids asking travelers to re-enter cards.
- Card lifecycle features: Network tokens and account updater keep stored cards current.
Cons
- Large-platform scope: Orchestration is more than a small agency needs, and GDS connectors and passport data are not published.
- No public price: Budgeting requires a sales cycle.
What Users Say
Positive, with 4.6/5 from 17 reviews on G2. One G2 reviewer says its tokens are not tied to a single gateway, so they move across gateways and survive a gateway switch; its Capterra listing has no reviews, so ask for a travel merchant reference.
7. Basis Theory: Best for OTAs Routing Card Data to GDS Partners and Suppliers
- Phone capture
- Not published on the travel page
- Starting price
- $995 a month with 20,000 tokens; free to start
- Supplier hand-off
- Routes cards to GDS partners, hotels, airlines, and suppliers
- Who it suits
- Online travel agencies with developers that capture cards in their own booking flow and send them to Sabre, Amadeus, and other partners.
Basis Theory is a token vault with a dedicated page for online travel agencies. It describes itself as an independent middleman that captures card data and routes it to any GDS, travel partner, or payment service provider.
Scenario: One Booking, Three Suppliers
A hosted form in the booking flow tokenizes the card and stores it in a vault the agency can use but does not maintain.
For each supplier, the stored card is sent to the GDS partner, hotel, airline, or local supplier without touching the agency’s own systems, with payloads formatted for each partner.
Key Features
- Hosted forms and APIs capture cards inside your booking flow.
- Stored cards can be sent to Sabre, Amadeus, or other partners.
- Payloads are formatted and enriched for each partner and processor.
- A backup provider can re-process failed payments.
Pricing: $995 a month including 20,000 tokens, with a PCI Attestation of Compliance, plus a custom plan through sales; you can get started for free.
Pros
- OTA-specific page: Its travel page names GDS partners, hotels, airlines, and local suppliers.
- Travel customer quote: Toggle Travel’s co-founder says it stores card number, expiry, and CVV for the card’s lifetime.
- AOC included: The published plan lists a PCI Attestation of Compliance.
Cons
- Developer product: Phone capture, advisor reveals, and passport intake are not published on its travel page.
- Higher entry price: $995 a month is a large step for a small agency.
What Users Say
No reviews yet on G2 or Capterra, so ask for an OTA reference and test one GDS hand-off before signing.
Which Tokenization Software Fits Your Travel Agency
If you already know which desk you run, this is the short version of the reviews above.
| Agency type | Best pick | Why |
|---|---|---|
| Host or leisure agency booking by phone | Enigma Vault | IVR, secure links, logged reveals, no developers |
| TMC receiving cards from GDSs and partners | PCI Booking | Inbound GDS and OTA card profiles |
| OTA automating supplier portals | VGS | Browser proxy fills supplier web pages |
| AI travel startup | Enigma Vault | Card Vault plus NoPII for traveler prompts |
| Airline or consolidator building its stack | PCI Proxy | Composable vault used by airline sellers |
| Platform booking many supplier APIs | Spreedly | Supplier receivers from one stored card |
| High-volume seller acting as MoR | IXOPAY | Orchestration across acquirers and currencies |
| OTA sending cards to GDS partners | Basis Theory | Routes stored cards to GDSs and suppliers |
One Card Token Across Many Suppliers
One trip can touch an airline, a hotel, a car rental desk, and a cruise line. The goal is one stored card and one token, with the real number sent only to the supplier that needs it.
| Supplier route | Platforms that document it | Gap to plan for |
|---|---|---|
| Gateway charge, agency as MoR | All seven | Gateway stays your choice |
| Airline, hotel, or cruise API | Spreedly, PCI Proxy, PCI Booking, VGS, Basis Theory | Each endpoint approved separately |
| Supplier web portal | VGS (browser proxy), Enigma Vault (logged reveal), PCI Booking, PCI Proxy | Third-party card rules vary |
| GDS PNR or NDC order | No PNR connector published | Reveal at booking, or via mid-office |
| Virtual card to supplier | PCI Booking | Not published by the others |
| Phone desk | Enigma Vault (Twilio Pay IVR), PCI Booking (card link) | Others need your own build |
AI travel startups face the same question for names and passport numbers in prompts. Among these seven, Enigma Vault (NoPII) and VGS (AI Data Firewall) document a proxy that tokenizes identifiers in LLM traffic. For supplier delivery feature by feature, see our card tokenization guide for travel agencies.
The itinerary assistant never sends a passport number: Point your assistant’s base URL at NoPII and names, passport numbers, and contact details are tokenized before the prompt leaves, then restored in the response. If tokenization fails, the request is blocked, and the Lite plan covers 1M tokens a month free.
How Each Platform Captures Traveler Cards
Before a card can go anywhere, it has to reach the vault without passing through an agent’s screen or your own servers. Capture is where most agencies first fall back into PCI scope.
| Capture channel | Risk if the card stays plain | Platforms that document it | Gap to plan for |
|---|---|---|---|
| Web and app booking | Checkout servers enter PCI scope | All seven | None |
| Phone and call center | Numbers in recordings, notes, and agent screens | Enigma Vault (IVR, links), PCI Booking (card link) | Others need your own build |
| Cards arriving from partners | Plain cards from OTAs, GDS queues, or files | PCI Booking (GDS profiles), PCI Proxy (SFTP), IXOPAY (batch) | Confirm each partner’s format |
Merchant of Record and PCI Scope for Travel Agencies
Who charges the card decides where it must go next, and which features you need.
| Booking model | Who charges the card | What the platform must do |
|---|---|---|
| Agency as merchant of record | The agency, on its merchant account | Charge stored tokens through your gateway |
| Supplier as merchant of record | Airline, hotel, cruise line, or tour operator | Release the card at booking; log who saw it |
| Mixed (most agencies) | Both, often within one trip | One token for charges and hand-offs |
| Virtual card to supplier | The agency, with a card it issues | Store and send issued cards |
Tokenization moves card custody to a Level 1 provider. Your agency still completes its own PCI DSS assessment, so ask each vendor for its responsibility matrix and check questionnaire eligibility with your acquirer or QSA.
The phone desk is where cards leak first: Twilio Pay sends the caller’s keypad entry straight into Card Vault, so the number never reaches the agent, the recording, or the CRM. The booking record keeps a token, and deposits run through the gateway you already use.
Cards and Passports in GDS PNRs and NDC Orders
A PNR in Sabre, Amadeus, or Travelport carries a form of payment, passport details, loyalty numbers, and free-text remarks. Apart from PCI Booking’s inbound GDS profiles, no platform here publishes a GDS connector, so placement is the rule: token in the CRM, card released only at the GDS step.
- Remarks and queues: Never store card numbers or CVVs in free text.
- Passport data: CBP’s APIS program requires passenger data for commercial flights into and out of the US; collect passports through secure intake.
- NDC orders: Apply the same rule: keep the token, and release the card only at the order step.
- CVV handling: CVV must not be kept after authorization; Card Vault deletes it within 30 minutes.
For passport, loyalty, and date-of-birth fields, see our guide to data tokenization software for travel agencies.
Questions to Settle With Your Acquirer and QSA
The right column shows what Enigma Vault states on its own pages, so you can compare each vendor’s answer line by line.
| Question | Why it matters | What to confirm with any vendor | Our answerEnigma Vault |
|---|---|---|---|
| Custody evidence | Your assessor needs proof of the vault’s controls | PCI level, AOC, and responsibility matrix | PCI DSS Level 1; AOC and matrix from Starter |
| Gateway choice | Agency-as-MoR bookings run on your merchant account | Which gateways the vault can charge through | Any REST gateway, including Stripe and Authorize.net |
| Supplier reveals | Supplier-charged bookings still need the card | Who can reveal it, and whether it is logged | Authorized staff only in Customer Vault; every reveal logged |
| Phone bookings | Recordings pull call centers into scope | IVR or link capture that bypasses the agent | Twilio Pay IVR into Card Vault |
| Fraud liability | Vaulting does not authenticate the traveler | 3D Secure support for card-not-present bookings | Not published; ask during the demo |
| Audit reports | Corporate clients audit their TMC | SOC 2 Type II and ISO 27001 status | SOC 2 Type II; ISO 27001 in progress |
| Next step | Bring one booking, from first call to supplier payment, to a call. | ||
What we ask agencies first: We start from the booking, not PCI vocabulary. How does each desk receive cards, which suppliers still need manual entry, are calls recorded, and how long are cards and passports kept? Some suppliers restrict third-party cards, so we check the supplier list before designing the reveal step.
Travel Agency Pricing Compared
| Platform | Published price | How it’s sold | Notes |
|---|---|---|---|
| Enigma Vault | $0 Lite; $49 to $499 a month | Self-serve; Customer Vault by engagement | AOC, matrix, SOC 2 from Starter |
| PCI Booking | Per card operation, from a few cents | Quote with a solutions engineer | PCI Level 1, ISO 27001:2022 |
| VGS | From $1,000 a month | Free trial, then sales | PCI Compliance Subscription on Growth |
| PCI Proxy | €350 or €650 a month plus usage | Free trial, then a demo | Documents not published |
| Spreedly | From $750 a month | Sales | Documents not on pricing page |
| IXOPAY | Not published | Custom quote after a sales cycle | Sandbox on request |
| Basis Theory | From $995 a month | Free to start, then sales | AOC on the published plan |
Protect Traveler Cards and Data With Enigma Vault
A Tuesday at a 30-advisor agency: a corporate traveler calls to rebook a flight, a honeymoon couple needs to send passports for a cruise, and the operations lead wants the AI itinerary pilot signed off before Friday.
With Enigma Vault, the rebooking card goes through Twilio Pay into Card Vault and is charged through the agency’s gateway, and the passports arrive through a Customer Vault link. NoPII tokenizes the itinerary prompts before the model provider sees them.
The evidence is ready for your QSA: PCI DSS Level 1 and SOC 2 Type II, with the AOC and responsibility matrix from Starter, and a 99.99% uptime SLA.
To map it to one real booking, book a demo or start in the Lite sandbox after reviewing pricing.
For card-on-file migration questions, contact our team.
