Transparent Data Flow
Secure Payment Data Transfer and API Integration
HostedPCI Transparent Data Flow enables businesses to collect, tokenize, and transmit credit card data, ACH information, and personally identifiable information (PII) between authorized systems without requiring their applications to handle the original data directly.
Designed for businesses that rely on external payment providers, booking platforms, and third-party APIs, Transparent Data Flow supports data exchange while helping organizations reduce unnecessary exposure to confidential information and minimize their PCI DSS scope.
What Is Transparent Data Flow?
Transparent Data Flow is a data transfer solution that allows HostedPCI to act as an intermediary between a business’s systems and external service providers.
Instead of requiring original payment details to pass through the merchant’s infrastructure, HostedPCI collects and stores the information within its protected environment and provides a token for the merchant to use.
When an authorized third-party system requires the original information, HostedPCI substitutes the token with the corresponding data and delivers it to the configured destination.
This allows businesses to maintain their existing workflows while HostedPCI handles the underlying data exchange through its PCI DSS Level 1 Service Provider infrastructure.
How HostedPCI Transparent Data Flow Works
Step 1: Collect Information
Data is collected directly from the customer through a supported HostedPCI form or iframe, or retrieved by HostedPCI from a file or message source when the merchant signals through an API request that the information is ready.
This allows businesses to collect payment details without routing the original information through their own applications, depending on the integration.
Step 2: Tokenize and Store
HostedPCI replaces the original information with a token and stores the underlying data within its protected infrastructure.
The merchant receives a token that can be used throughout its workflow without storing the original card number or other tokenized information.
Step 3: Deliver Data to an Authorized Third Party
When the merchant’s workflow requires the original information, it initiates the configured transmission using the corresponding token.
HostedPCI retrieves the associated data, substitutes it for the token as required by the integration, and delivers the information directly to the authorized destination.
The merchant continues using tokens within its own systems while HostedPCI handles the transfer of original data.
Key Features and Business Benefits
Data Collection and Tokenization
Collect and tokenize credit card details, ACH account information, and supported PII through HostedPCI, reducing the need for internal applications to handle the original information.
Third-Party API Data Transmission
Transmit original data to authorized external systems, including payment providers, booking platforms, and other third-party applications that require it to complete business processes.
Controlled Detokenization
HostedPCI delivers original data to destinations configured for the account during implementation.
Access permissions and audit logging provide additional oversight of sensitive data handling, where supported by the configured integration.
PCI DSS Scope Reduction
By limiting how cardholder information enters or passes through merchant systems, Transparent Data Flow can help businesses reduce their PCI DSS compliance scope, depending on their integration and overall environment.
This may reduce the number of internal systems involved in PCI DSS assessments and simplify payment data management.
Tokenizing ACH information and PII can similarly help limit where that information is exposed within an organization’s environment.
Who Is Transparent Data Flow For?
Travel Agencies and Online Booking Platforms
Collect payment details during the booking process and deliver the required information to airlines, hotels, or other travel suppliers when payment is ready.
Enterprise Payment Platforms
Support workflows involving external payment processors and service providers while limiting direct handling of cardholder data within internal systems.
SaaS and Software Providers
Connect applications with third-party systems that require payment or other confidential information without storing the original data directly within the software platform.
Use Case: Secure Payment Data Transfer for Travel Bookings
A travel booking company needs to collect a customer’s credit card information before confirming airline ticket availability.
The booking process involves multiple requests to the airline. Initial requests verify ticket availability, while the final request requires the original credit card information to complete payment.
With HostedPCI Transparent Data Flow:
- Collect Payment Information: The customer enters their credit card details through a HostedPCI-hosted payment form or iframe.
- Tokenize and Store: HostedPCI stores the original card information and provides a token to the travel company’s booking platform.
- Verify Availability: The booking platform completes its airline availability checks using its existing workflow.
- Complete the Payment Request: When the booking is ready, the travel platform initiates the configured payment data transfer using the token. HostedPCI substitutes the corresponding card details and delivers the required information directly to the airline.
The travel company can complete its booking process without storing the original card number within its own systems.
Need to transmit payment information to an external provider?
Contact HostedPCI to discuss how Transparent Data Flow can support your third-party integration requirements.
Transparent Data Flow FAQs
What types of information does Transparent Data Flow support?
HostedPCI Transparent Data Flow supports workflows involving credit card data, ACH account information, and personally identifiable information (PII).
Available collection, tokenization, and transmission methods depend on the integration and service configuration.
Can Transparent Data Flow transmit cardholder information to third-party APIs?
Yes. HostedPCI delivers original payment information to authorized third-party systems when required by the business workflow.
Supported destinations and integration requirements are established during implementation.
Can businesses continue using their existing payment providers?
Yes, in many cases. Transparent Data Flow supports integration with external payment providers and existing business workflows.
Compatibility depends on the provider’s API requirements and the intended data exchange.
Does Transparent Data Flow eliminate PCI DSS compliance requirements?
No. Transparent Data Flow can help reduce PCI DSS scope by limiting where cardholder data is handled.
The merchant’s remaining compliance obligations depend on its implementation, systems, and payment processes.
How are card security codes (CVV) handled?
Card verification codes are classified as sensitive authentication data under PCI DSS.
PCI DSS prohibits storing these codes after authorization, even if encrypted. Any handling before authorization must comply with applicable security requirements and payment brand rules.
Businesses requiring CVV as part of a delayed payment or pre-authorization workflow should confirm the supported collection, handling, and retention options with HostedPCI.
Can Transparent Data Flow support file-based data collection?
Yes. HostedPCI supports workflows where a merchant signals through an API request that a file or message is ready for collection.
HostedPCI retrieves and tokenizes the information according to the configured integration, reducing the need for the merchant’s applications to handle the original data directly.
Discuss Your Data Transfer Requirements
Need to collect payment information or transmit data to external systems?
Contact HostedPCI to discuss your integration requirements.
Explore HostedPCI Documentation to learn more about supported integration options.
Case Studies
Travel
This merchant required the ability to collect and store credit cards securely from their booking page until required for payment. The transaction process starts with the first 2 requests being sent to the airline company to determine if tickets were available and then the 3rd transaction needs to be sent securely with the credit card number to the airline.