Overview#
Payment Card DLP and Tokenisation detects payment card numbers in uploads, recognised text, and free-text evidence, replaces them with reversible vault tokens held under an organisation-controlled key, and gates any later reveal behind explicit permission and audit.
Payment card numbers appear in places they should not: scanned forms, call notes, uploaded screenshots, email attachments, and free-text evidence. Once raw card data lands in the wrong store, the organisation inherits risk it never intended to take on. The module combines Luhn and brand-aware detection, upload scanning, OCR text protection, reversible vault tokenisation, automatic export redaction, role-gated reveal, customer-managed keys, key rotation support, and durable audit evidence, all activated per organisation through a self-service settings page. It is designed for organisations that occasionally handle payment data but do not want raw card numbers spreading through operational systems.
Key Features#
- Context-Aware Payment Card Detection: Identify likely card numbers using format, issuer brand pattern, surrounding context, and Luhn checksum validation, tuned to reduce false positives and to catch numbers wrapped across lines or split into adjacent fields.
- OCR Text Protection at Approval and Ingestion: Replace card numbers in recognised text both when raw OCR output is first ingested and again at OCR review approval, so raw card numbers are never persisted in transcription text. Document provenance, including hashes, signatures, and revision history, stays consistent with the protected text.
- Upload Policy, Block or Monitor: Scan text-like uploads on the exact finalised bytes, then either block the upload fail-closed or record the finding in monitor mode. Original evidence files are never modified, preserving chain of custody.
- Automatic Export Redaction: A dedicated payment-card redaction type in the redaction and export engine removes card numbers from exports before material leaves the platform.
- Reversible Vault Tokenisation: Store a deterministic, governed token in place of each detected card number; the original can be recovered only through an approved workflow.
- Role-Gated Reveal: Require explicit permission before a user can view protected card data; every disclosure is recorded and originals are returned only to cleared callers.
- Customer-Managed Vault Keys: Each organisation generates, sets, revokes, and monitors its own vault key through self-service administration, with no platform operator involvement. Key status shows a fingerprint only, never key material. There is no fallback to a shared platform key, so a missing or invalid key fails closed, and every organisation's tokens are cryptographically isolated from all others.
- Self-Service Activation: Protection is opt-in per organisation behind a staged activation gate. A dedicated Data Loss Prevention page in settings shows live status covering protection state, key registration, and activation, offers generate-or-import key setup with a one-time reveal and explicit save-it-now guidance, and requires confirmation before key revocation. Policy flags merge safely, so enabling one protection never disables another.
- Rotation Recovery: A one-generation key rotation recovery path preserves controlled access to previously tokenised data, with preserve-or-abort semantics so tokens are never silently orphaned.
- Durable Audit Records: Detection and tokenisation produce durable audit records that carry match counts, card brands, and the last four digits only, never the full number, and every reveal of an original value is separately recorded.
Use Cases#
- Evidence Upload Protection: An investigator uploads a screenshot that contains a card number, and the recognised text is tokenised before it is stored.
- Council Payment Enquiry: A resident includes card details in a service request, and staff see a redacted operational view while finance users follow a controlled reveal path if needed.
- Healthcare Billing Attachment: A scanned billing document is OCR processed with card numbers protected before review.
- Internal Fraud Review: Authorised investigators reveal tokenised card data when justified, for example to answer a subpoena, with every reveal captured in the audit trail.
- Disclosure Export Redaction: A disclosure officer exports case material and the platform automatically redacts card numbers before the bundle leaves the platform.
- Reduced Cardholder Data Exposure: Organisations avoid unnecessary spread of raw cardholder data across case and evidence workflows, and compliance teams can show that card data at rest is protected under a customer-held key.
Integration#
Payment card DLP connects to file upload, OCR, evidence review, redaction and export, case management, key management, role-based access control, and audit logging. Organisation administrators activate and govern the capability themselves through the Data Loss Prevention page in platform settings, which is localised across the platform's supported languages. It works alongside broader data loss prevention policies but adds payment-card specific detection, tokenisation, and reveal governance.
Open Standards#
- PCI DSS v4.0: Controls support protection, restriction, monitoring, and auditability of cardholder data.
- ISO/IEC 27001:2022: Access control, cryptographic protection, logging, and monitoring controls frame operational governance.
- NIST SP 800-57: Key management practices align with guidance for cryptographic key lifecycle and rotation.
- GDPR, Regulation (EU) 2016/679: Tokenisation and minimisation reduce unnecessary exposure of personal financial data.
- ISO 8601: Detection, tokenisation, reveal, and audit timestamps use standard date-time formatting.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16