Hyperswitch Card Vault

Overview

Hyperswitch Card Vault is a service for tokenizing and storing payment credentials separately from a merchant’s main application. It suits payment teams that want control of their vault or need a managed option alongside existing processor connections. Its breadth of credential handling and deployment choices is appealing, but running it yourself also means owning setup and compliance.

Key features

The Vault and Forward API stores card details as tokens and routes them to supported processors or endpoints. It supports raw card details, network and processor tokens, bank credentials, wallet credentials, and other sensitive data through its flexible data APIs. Cards are associated with merchant and customer identifiers, and internal hashing checks help avoid duplication. That range is useful for teams managing several credential types, but it also calls for careful configuration and governance.

Proxy payments can substitute a vault token with card data and forward a payment request through an existing PSP connection, without requiring PSP reintegration. Keeping raw card data inside the vault can reduce PCI DSS scope; it does not remove the operator’s compliance responsibilities. The product page cites tokenization through 50+ processors and network tokens across Visa, Mastercard, and Amex, which is relevant for merchants working across providers.

Integration options reflect different compliance situations: merchants that are not PCI compliant can use an SDK, while PCI-compliant merchants can connect server to server. Data is signed before transmission, encrypted to the vault, re-encrypted with AES for storage, and held in a database encrypted at rest. Optional protections include JWE encryption and JWS signing middleware, key-custodian protection that requires two keys to decrypt the master key, and AWS KMS encryption for keys and sensitive data passed during startup. These controls offer useful layers, but the team operating a self-hosted vault must configure and maintain them.

Hyperswitch cites 99.999% uptime, response times under 50 ms, and throughput above 20,000 transactions per second. Those figures make ambitious performance claims; teams should weigh them alongside the operational demands of their chosen deployment.

Pricing

The Community Edition keeps software costs at zero, but not the work of managing compliance or the service itself; support is through public Slack and GitHub discussions. The paid plans add SLA-driven support and a dedicated account manager. Cloud also shifts hosting to Hyperswitch and includes 210+ integrations rather than the 90+ offered by the self-hosted editions.

Platforms

Hyperswitch Card Vault is an API service for Linux and self-hosted deployment. Teams can run the locker in Docker or as a Cargo executable, with a database and configuration required. The vault can be deployed on-premises or in the cloud, or used as a managed service hosted by Juspay. This flexibility fits teams with infrastructure capacity; it is less attractive to those seeking a turnkey local app.

Who it's for

This is a strong fit for payment teams that need to keep credentials outside their main application, use tokenized payments with existing PSP connections, or manage several types of sensitive payment data. It is also suited to organizations that want to self-host and take responsibility for compliance, or are willing to use Hyperswitch Cloud for managed hosting. Teams without the capacity to operate a vault or oversee compliance should look elsewhere or choose the managed plan.

Pros and cons

• Pros: Free, open-source self-hosting gives teams control over deployment and compliance choices.
• Pros: Vault and Forward supports a broad range of credentials and can work through existing PSP connections without reintegration.
• Pros: Documented encryption, signing, key-custodian, and AWS KMS options provide multiple ways to protect data and keys.
• Cons: Community users must operate the service and manage compliance end to end; support is community-based.
• Cons: Self-hosting requires a database, configuration, and operational setup, making it a poor fit for teams seeking a hands-off vault.

Alternatives

Payment Tokenization Software is a broader category to compare if you want to weigh vaults and tokenization tools side by side.

American Express Token Service is worth considering for teams seeking an Amex-focused option with no deployment or use fees stated and availability that varies by market.

DeloPay may suit teams that prefer a transaction-priced service: its Power plan is $2.25 a month, billed at 2.25% per transaction for monthly volume from $100,000 to $500,000.

Basis Theory is a paid alternative for teams considering a platform with a stated monthly fee: Standard platform costs $995 a month and includes 20,000 tokens, with additional tokens charged at $0.05 each.

Cashfree Token Vault is another paid vault option for readers comparing alternatives.

FIS Data Integrity Manager is a paid, web-based alternative.

Very Good Security is a paid alternative with a Starter Package at $1,000 a month and a free starting option.

Worldpay eProtect is another paid option for readers comparing payment-data services.

Mastercard Decision Intelligence is a paid alternative with custom pricing for its Decision Intelligence Pro plan.

Verdict

Choose Hyperswitch Card Vault if your payment team wants an open-source vault, broad credential support, and control over deployment, and can take on the setup and compliance work. Its strongest case is tokenized forwarding through existing PSP connections without reintegration. Look elsewhere if you need a fully managed service or do not have the capacity to run a security-sensitive vault.