How does token portability work?
A token is only a reference; the card number behind it sits in the provider’s vault. To move, the old provider exports the card numbers and the new one imports them and issues its own tokens. Stripe says it can transfer card data only to another PCI DSS Level 1 compliant processor, which must show its Attestation of Compliance and a PGP public key of at least 4096 bits. Stripe then sends an encrypted file with card details, email addresses and metadata, but not payment history or subscriptions. Braintree similarly asks for an attestation of PCI compliance and a public encryption key.
Why does it matter?
Without an export, every customer must enter their card again, and some never do. As an illustrative example: a subscription business with 20,000 saved cards switches provider. If 25% of customers do not re-enter their card within a month, 5,000 subscriptions lapse; a successful migration avoids most of that. Adyen suggests sending new sign-ups to the new provider while existing recurring charges stay with the old one until the import is done, and says migration usually takes 10 days or more.
What are the limits?
Not every credential moves. Stripe excludes cards saved through its Link wallet from exports, and its import guide warns that migrated data may lack details such as the network token or the original transaction ID, which can cause some declines after the switch. Many processors, Stripe notes, require the account owner to request the transfer, so export rights belong in the contract.
Where does Omno use it?
Omno stores saved cards at the orchestration layer rather than in one PSP’s vault, so the same saved card can be routed and cascaded to any eligible provider, and changing providers does not mean asking customers to re-enter cards. Moving existing card data from a current provider depends on that provider’s export process. Which token types, vault or network, are available depends on the providers.