- Home
- Payment Tokenization Software
- Hyperswitch Card Vault
Hyperswitch Card Vault
What it is
Hyperswitch Card Vault is an open-source service for tokenizing and securing payment credentials separately from a merchant’s main application server. It can store card details, bank and wallet credentials, and other sensitive information through its /data and /cards APIs. The Vault and Forward API can route stored payment data to supported processors or endpoints, while proxy payments can use existing PSP connections without requiring reintegration. Merchants can connect through an SDK or directly server to server, and deploy the service on-premises, in the cloud, or through managed hosting by Juspay. Security measures described in the setup materials include JWE and JWS communication middleware, optional two-key custody, AES re-encryption for storage, and database encryption at rest. The product page states tokenization is available through 50+ processors and references network tokens for Visa, Mastercard, and Amex. Community Edition is free and is self-hosted, with community support. Enterprise and managed options have no listed price.
For and against
For
- Stores card, bank, wallet, and other sensitive credentials.
- Supports SDK and direct server-to-server integration.
- Offers on-premises, cloud, and managed deployment options.
- Community Edition is free.
Against
- Self-hosting requires a database and configuration.
- Key custodian protection is optional and requires two keys.
The verdict
Hyperswitch Card Vault centers on credential storage, tokenization, and forwarding, with both self-hosted and managed deployment paths. Teams should account for deployment configuration and the differing support and pricing details across editions.
Who it suits
The vault suits merchants and engineering teams that need to separate payment credentials from their main application and configure their own deployment. It also offers a managed-hosting option for teams that do not want to self-host.
Plans and prices
Self-Host Community Edition
Self-hosted; manage compliance end to end; 90+ payment integrations; community support
Read 4 Oct 2026 · hyperswitch.io
Integrate Hyperswitch Cloud
Managed hosting; 210+ payment integrations; SLA-driven support; dedicated account manager
Read 4 Oct 2026 · hyperswitch.io
Self-Host Enterprise Edition
Self-hosted; 90+ payment integrations; SLA-driven support; dedicated account manager
Read 4 Oct 2026 · hyperswitch.io
On the record
- AWS KMS
- The setup guide describes an AWS-specific KMS feature that adds encryption for keys and sensitive data passed to the vault during startup.github.com · read 4 Oct 2026
- Communication security
- The setup guide describes JWE encryption and JWS signing middleware for communications between tenant applications and the vault.github.com · read 4 Oct 2026
- Community support
- The pricing page lists free support through the public Slack channel and GitHub discussions for the Community Edition.hyperswitch.io · read 4 Oct 2026
- Data protection
- Hyperswitch documents signing card data before transmission, encrypting it to the vault, re-encrypting it with AES for storage, and encrypting the database at rest.github.com · read 3 Oct 2026
- Deployment
- The vault page says it can be deployed by customers on-premises or in the cloud, or used as a managed service hosted by Juspay.hyperswitch.io · read 3 Oct 2026
- Deployment and audience
- The setup guide documents running the vault in Docker or running the executable with Cargo, for teams configuring and operating their own service.github.com · read 4 Oct 2026
- Duplicate prevention
- The repository overview says internal hashing checks are used to avoid data duplication.github.com · read 4 Oct 2026
- Encryption at rest
- Hyperswitch documentation says card data is re-encrypted internally with AES and the database is encrypted at rest.github.com · read 4 Oct 2026
- Flexible data
- The vault is designed to store different types of sensitive information and supports APIs on the /data and /cards endpoints.github.com · read 4 Oct 2026
- Integration options
- The vault can be integrated through an SDK for merchants that are not PCI compliant or directly server to server for PCI-compliant merchants.hyperswitch.io · read 3 Oct 2026
- Key custody
- The optional key custodian feature requires two keys to decrypt the master key before vault functions can run.github.com · read 4 Oct 2026
- Maker headquarters
- Juspay says it is headquartered in Bangalore.juspay.io · read 3 Oct 2026
- PCI scope
- The proxy payment flow is described as reducing PCI DSS scope by keeping raw card data within the vault.github.com · read 4 Oct 2026
- Performance claims
- The product page lists 99.999% uptime, response time under 50 ms, and throughput of 20k+ transactions per second.hyperswitch.io · read 3 Oct 2026
- Processor connections
- Proxy payments are described as working with existing PSP connections without requiring PSP reintegration.github.com · read 4 Oct 2026
- Processor coverage
- The product page states that tokenization is available through 50+ processors and references network tokens across Visa, Mastercard, and Amex.hyperswitch.io · read 3 Oct 2026
- Purpose
- Hyperswitch Card Vault is an open-source Rust service for securely storing sensitive information such as payment card and bank account details.github.com · read 4 Oct 2026
- Security features
- The setup guide describes optional key custodian protection, JWE and JWS encryption middleware, and AWS KMS encryption for keys and sensitive data passed during startup.github.com · read 3 Oct 2026
