Definition
Tokenization substitutes a token for card data; security, PCI scope and portability depend on how it is implemented.
Tokenization separates a usable payment reference from the underlying card number. It does not remove the need to understand who can resolve that reference, where card data still flows, or which controls apply.
Two tokens, different dependencies
| Question | PSP vault token | Network payment token |
|---|---|---|
| What does it represent? | A reference to a credential held in the provider's vault | A substitute payment credential constrained to a permitted domain |
| Can another processor use it? | Usually needs the vault provider's supported forwarding or migration process | Requires compatible processor, token-requestor and network arrangements; not universal portability |
| What happens after card replacement? | Depends on account-updater and vault services | Lifecycle services can update the underlying account association; eligibility and token status still matter |
Adyen's network-token documentation describes merchant/shopper-specific tokens, lifecycle updates and supported forwarding. These are product capabilities, not a promise that every token can move unchanged to any processor.
PCI scope is an architecture question
The PCI Security Standards Council says tokenization's effect on PCI DSS scope depends on the implementation. Tokenization systems and systems handling card data remain relevant to the assessment. Merely storing PAN does not establish a merchant's assessment level; merely storing a token does not prove the whole merchant environment is out of scope.
Map the browser, application, vault, detokenization permissions and downstream integrations with the provider and assessor. The important question is where PAN can be accessed, processed or transmitted, not what the database column is called.
What to measure before migration
Hypothetical decision: a merchant stores customer-token-42 from provider A and wants to send a recurring payment through provider B. Sending that reference unchanged to B is not a migration plan. Ask whether A can forward or export credentials securely, whether B supports the resulting credential and whether the existing customer authorization covers the intended use. Never put real PANs into an ordinary CSV export.
Measure authorization outcomes on comparable issuer, market and transaction cohorts. A provider's reported improvement is not guaranteed for your traffic. Tokenization also does not by itself establish authentication or dispute-liability protection: check the applicable transaction and scheme rules.
Continue with network tokens for credential scope, card on file for storage and permission boundaries, or the orchestration architecture guide for vault ownership.