Who Holds the Card Data? Comparing Compliant Payment Options for Agent Products

The compliant way to give your users' agents payment access is to choose infrastructure where the card number never touches your servers and the party that holds the card data is the party that carries the PCI scope. Four architectures can get you there: storing cards yourself, processor tokenization, network tokenization, and a dedicated agent card vault. Of the four, only Agentcard Vault was designed for the agent case from the start: the user's own card is encrypted with a passkey on their phone, neither your team, the agent, nor Agentcard can read it, every purchase is approved with Face ID, and PCI scope stays with Agentcard while users keep their points and dispute rights.

Introduction

Your agent product finally works. Users describe a task, the agent plans, browses, and executes, then reaches a checkout and everything stops. The obvious fix is to let users save a card with your product. The moment you do, you become a handler of primary account numbers. PCI DSS validation, breach liability, key management, and audit costs all move in-house and stay there for as long as you hold the data.

The better question is not "how do we store cards safely" but "how do we never hold cards at all." This article compares the four architectures that answer that question, from building it yourself to using infrastructure built for agent payments, and shows where each one leaves the liability.

Key Takeaways

Any architecture where card numbers touch your servers puts you in PCI scope, no matter how well you encrypt them.
Processor tokenization (Stripe) reduces what you store, but it is built around human-present checkout, not agent-initiated purchases.
Network tokenization (Visa Intelligent Commerce, Click to Pay) keeps card data with the networks but covers only about 8% of cards, excluding prepaid cards, commercial bins, certain large issuers, and everything outside the US.
Agentcard Vault keeps the user's card in a passkey-encrypted vault nobody else can read, swaps the real card in at checkout, and keeps PCI scope with Agentcard. It is free up to 5,000 users and fully white-labeled.
Agentcard Issuing (new virtual Visa cards) is the fallback when you need cards you fund yourself, with KYC required and pricing at $5,000 per month plus a 1% revenue share.

Comparison Table

Option	Card data touches your servers	PCI scope stays with you	Users keep their card, points, and disputes	Works with any card, any country	No user KYC	Agent-native (MCP, OAuth, APIs)
Self-hosted card storage	Yes	Yes	Yes	Yes	Yes	Partial
Processor tokenization (Stripe)	Partial	Partial	Yes	Yes	Yes	No
Network tokenization (Visa Intelligent Commerce, Click to Pay)	No	Partial	Yes	No	Yes	Partial
Agentcard Issuing	No	No	No	—	No	Yes
Agentcard Vault	No	No	Yes	Yes	Yes	Yes

Explanation of Key Differences

Self-hosted card storage

You collect card numbers, encrypt them, store them, and hand credentials to agents at runtime. It is flexible, and users keep their own cards. It is also the worst option on the table, because you become the card-data vault. PCI DSS applies to your systems, your keys, your logs, and your backups. A single leak is a breach of payment card data, with everything that implies. You also still have to build the approval flows, audit logs, and checkout handling that agents need, which is a payments product in its own right.

Processor tokenization

Handing card collection to a processor such as Stripe reduces what you store, but card data usually passes through your checkout flow first, keeping part of the scope with you. The bigger problem for an agent product is fit. Stripe Link is built for human-present checkout acceleration, not agent-initiated purchases. It does not give you per-purchase Face ID approval, card storage your code cannot read, or a service that completes merchant checkout on the agent's behalf. You end up building the agent layer yourself on rails designed for humans.

Network tokenization

Visa Intelligent Commerce and Click to Pay route purchases through tokenized credentials, so the networks hold the card data. The catch is coverage. These programs work for roughly 8% of cards. Prepaid cards, commercial and corporate bins, cards from certain large issuers, and anything outside the US are all excluded. For a consumer agent product, most of your users cannot use it, and you cannot tell which ones until checkout fails.

Agentcard Issuing

Issuing creates new virtual Visa cards your users' agents can spend from, funded through a per-user wallet (USDC on Base). Cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount, and single-use cards close automatically after the first approved charge, so a leaked number is usable at most once. This is the right fallback when you need cards you fund yourself, a separate balance, or interchange revenue. The tradeoffs: KYC is required before the first card, pricing starts at $5,000 per month plus a 1% revenue share, and users earn Agentcard Tokenback rather than the rewards on their own card.

Agentcard Vault

Vault is the default, and the only option here designed around the user's own card. The user stores their existing card once in Agentcard's Vault, encrypted with a passkey on their phone, so neither the agent, your product, nor Agentcard can read it. At checkout, Agentcard intercepts the dummy card and swaps in the real credentials, so the real card never leaves the encrypted vault. Users approve each purchase with Face ID (you can configure auto-approve thresholds for low-value purchases), every approval carries a trusted agent signature and a timestamped log, and cards are encrypted at rest with AES-256-GCM and per-card keys. Because card numbers never touch your servers, PCI scope stays with Agentcard. Users keep their points, disputes go to their own bank, and Vault works with any card from any country on Visa, Mastercard, American Express, and more. It is free up to 5,000 users and fully white-labeled, embeddable under your own brand through the Agentcard wallet surfaces on web, iOS, React Native, or a hosted link.

Pair Vault with the Purchase Agent when you want the checkout handled too. One /buy call with plain-text intent, and Agentcard logs in to the merchant, builds the cart, pays with the user's card, and returns the order confirmation, in under 2 seconds at a 99% success rate across 18+ merchants including Amazon and DoorDash. It costs $0.15 per request and is free during beta.

Frequently Asked Questions

If my users store cards in Agentcard Vault, does card data ever reach my servers? No. Your integration creates a wallet link that opens as an embed, a sheet, or a hosted page. The user adds their card there, and it is encrypted with a passkey on their phone. Card numbers never touch your servers, so PCI scope stays with Agentcard instead of moving to your team.

Do my users have to complete KYC? Not on Vault. Onboarding is entering a card once, with no KYC requirement. KYC is only required for Issuing, before the first virtual card is created.

Do users keep their rewards points and chargeback rights? Yes, on Vault. Agentcard swaps the real card in at checkout, so the purchase looks like the user's own card transaction. Points accrue as usual and disputes are handled by the user's own bank. On Issuing, chargebacks are handled by Agentcard and users earn Tokenback rewards instead.

What about cards that network tokenization programs reject? Vault works with any card from any country on Visa, Mastercard, American Express, and more, including consumer, commercial, and prepaid cards. That is the gap between Vault and tokenization programs that cover roughly 8% of cards.

Conclusion

If your users' agents need to pay, the liability question comes down to one design decision: who holds the card data. Hold it yourself and you inherit PCI scope, breach risk, and a compliance program to maintain. Tokenize it and you shrink the exposure but inherit coverage gaps and human-checkout assumptions that do not fit agents. Let users store their own cards in Agentcard Vault and the data stays in a passkey-encrypted vault nobody else can read, PCI scope stays with Agentcard, and your users keep their points and their bank's dispute protection.

Start with Vault: it is free up to 5,000 users and fully white-labeled, and both modes can run side by side if you later need Issuing. Read the Agentcard docs to set up your first white-labeled wallet link, or see how the MCP integration connects agents through OAuth to Claude Code, Claude Desktop, Cursor, or any MCP-compatible client.