Your customers' card data should never touch your servers in plain text. That is not a preference: it is a PCI requirement, and failing it puts your merchant account, your funding, and your ability to accept cards at risk.
The EPD Commerce Payment Vault is how Easy Pay Direct handles this for merchants on the platform. Card data is captured and encrypted in a dedicated, isolated vault. Raw card numbers never pass through EPD Commerce systems directly. Your transactions route through that vault to your processor, and your PCI compliance posture stays clean.
Table of Contents
What the EPD Commerce Payment Vault does and who it helps
The EPD Commerce Payment Vault is built for merchants who need PCI-compliant card storage without managing that infrastructure themselves.
Here is how it works:
- A customer enters card details at checkout.
- Those details are captured and encrypted in the EPD Commerce Payment Vault before they touch any EPD Commerce server.
- The vault routes the transaction to your processor, whether that is Easy Pay Direct or Authorize.net.
- Your systems never store or transmit raw card data.
The practical result: you are PCI compliant, your customers' data is protected, and your processing continues without interruption.
This is live in production for Easy Pay Direct merchants. Existing integrations, including Authorize.net, continue to operate normally.
Why raw card storage is a liability you do not need
Storing raw card numbers creates a compliance scope that follows your business everywhere: audits, questionnaires, potential fines, and the risk of a breach that ends your processing relationship entirely.
Tokenization eliminates that scope. The vault holds an encrypted token tied to the card. The token is what moves through your system. If it were ever exposed, it is useless without the vault's decryption layer.
For merchants processing volume at scale, this distinction matters. A single breach incident is enough to lose your merchant account. Removing raw card data from your environment removes that category of risk.
What stays the same, and what improves
Switching to vault-based processing does not require rebuilding your checkout. Your existing processor connections remain intact.
What changes:
- Card capture now happens through the vault, not directly to a processor endpoint.
- Transactions route through the vault to Easy Pay Direct or Authorize.net as configured for your account.
- All transaction data feeds into EMAP for reporting, so your records stay complete.
- Your PCI compliance posture is confirmed: no raw card data in EPD Commerce systems.
Authorize.net represents a significant share of processing volume on the platform and is included in the vault architecture as a supported backend, alongside Easy Pay Direct merchant accounts.
Card auto-updater: fewer declines from expired cards
One feature worth noting for merchants with recurring billing or stored payment methods: the vault includes card auto-update functionality.
When an issuing bank reissues a card with a new number or expiration date, the vault receives the update automatically. Your stored payment methods stay current. Recurring charges that would have failed on an expired card continue to process.
This runs automatically for merchants using vault-based storage. It does not require action on your part and does not require notifying customers to re-enter their card.
Network tokens: coming for supported processors
Network token support is coming soon. A network token is issued directly by the card networks (Visa, Mastercard) and replaces the card number at the transaction level, providing higher approval rates and additional fraud signals.
When available, merchants will be able to enable or disable network tokens at the account level.
When network tokens become available for your processor, they will be an option you can turn on, not a required change.
Frequently asked questions
Does the EPD Commerce Payment Vault make my business PCI compliant?
The vault is designed to keep raw card data out of EPD Commerce systems entirely, which significantly reduces your PCI compliance scope. Card data is captured and encrypted in the vault before it touches any EPD Commerce server. You should confirm your full PCI posture with your compliance advisor, but vault-based processing removes the highest-risk element: raw card storage on your own infrastructure.
Which processors work with the EPD Commerce Payment Vault?
The vault currently supports Easy Pay Direct and Authorize.net as processing backends. Transactions are routed from the vault to your configured processor. Existing integrations continue to operate normally through the vault architecture.
Will switching to the vault affect my checkout or customer experience?
No. Card capture through the vault happens transparently. Customers enter their details the same way they always have. The vault layer encrypts and routes that data behind the scenes without changing what the customer sees or does.
What happens to my stored card data if a card is reissued?
The vault includes a card auto-update feature. When an issuing bank reissues a card with a new number or expiration date, the vault receives the updated information automatically. Stored payment methods update without requiring the customer to re-enter their card details, which protects recurring billing from unnecessary declines.
Does the vault support network tokens?
Network token support is coming soon. When the feature is available, merchants will have the option to enable or disable network tokens at the account level.
Is this feature available to all Easy Pay Direct merchants?
The vault is live in production for Easy Pay Direct merchants. Support for Authorize.net is included in the architecture. If you are an existing Easy Pay Direct merchant and want to understand how the vault applies to your account, the best step is to speak with the team directly.
If your business needs PCI-compliant card storage and processing that does not depend on you managing the infrastructure yourself, talk to a specialist at easypaydirect.com.