Softwr

APIs · head to head

Basis Theory vs Very Good Security

Basis Theory logo

Basis Theory

APIs

Developer tokenisation platform that holds card and sensitive data inside a PCI Level 1 environment you do not operate

From
$995/month
Rated
-
Full reviewWebsite
Very Good Security logo

Very Good Security

Cybersecurity

Tokenisation proxy that keeps card and personal data out of your own systems and out of PCI scope

From
$1000/month
Rated
-
Full reviewWebsite

The short version

  • Each has a real cost: Basis Theory the Starter plan is 995 US dollars a month before any volume, which is a real floor for an early stage company and puts the product out of reach of teams tokenising a few thousand records.; Very Good Security vGS sits in the live path of every request carrying sensitive data, so its latency and availability become yours, and an outage in the proxy is a payment outage no matter how healthy your own systems are.
  • They diverge on capability: Basis Theory covers Tokenisation API, Very Good Security covers Aliasing proxy.
  • Prices and features above were last checked on 31 August 2026.

Where they differ

Only the attributes on which Basis Theory and Very Good Security actually diverge.

Attributes where Basis Theory and Very Good Security differ
AttributeBasis TheoryVery Good Security
Starting price$995/month$1000/month
Pricing modelPer month by token volumePer month
PlatformsWeb, iOS, Android, LinuxWeb, API
CategoryAPIsCybersecurity

Identical on both: free tier (No), user rating (Not yet rated).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Basis Theory

  • Tokenisation API
  • Hosted elements
  • Outbound proxy
  • PCI attestation of compliance
  • Processor portability
  • Reactors
  • Access controls and audit
  • PII and PHI options

Only in Very Good Security

  • Aliasing proxy
  • PCI scope reduction
  • Network tokenisation
  • Processor optionality
  • Card issuing data
  • Vault and access controls
  • Data residency options
  • Compliance artefacts

What people use each for

The jobs each tool is most often brought in to do.

Basis Theory

  • A payments company that wants card on file without bringing its own infrastructure into PCI scope and paying for the assessment that followsnot Very Good Security
  • A merchant locked into a processor by that processor vault that wants to hold its own tokens and route to more than one acquirernot Very Good Security
  • A fintech collecting bank account and identity data that needs it isolated from its application database before an enterprise security reviewnot Very Good Security
  • A team that needs to send stored card data to a third party for a one-off integration without that data traversing its own serversnot Very Good Security

Very Good Security

  • A marketplace facing its first PCI DSS Level 1 assessment that wants to keep card data off its own estate rather than harden a dozen servicesnot Basis Theory
  • A merchant negotiating with a second acquirer that needs card credentials portable so the negotiation is real rather than theoreticalnot Basis Theory
  • A fintech collecting bank account and identity documents that wants sensitive fields absent from logs, backups and analytics warehouses by constructionnot Basis Theory
  • A card issuer that must display a full PAN in its own mobile app without the app or its backend touching cardholder datanot Basis Theory

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Basis Theory

  • The Starter plan is 995 US dollars a month before any volume, which is a real floor for an early stage company and puts the product out of reach of teams tokenising a few thousand records.
  • Starter is limited to the US region, so a company with European data residency requirements is pushed into a quoted Scale or Enterprise agreement immediately.
  • Log retention on Starter is 24 hours, which is well below what most security teams expect for a system holding cardholder data and forces an upgrade for reasons unrelated to volume.
  • Migrating away means moving card data out of the vault, which requires processor and assessor involvement and is slow, so the portability argument that attracts buyers cuts against them at exit.
  • An attestation of compliance covers the vendor environment, not your assessment; your assessor still decides what is in scope, and buyers occasionally discover their integration pattern pulled systems back into scope anyway.

Very Good Security

  • VGS sits in the live path of every request carrying sensitive data, so its latency and availability become yours, and an outage in the proxy is a payment outage no matter how healthy your own systems are.
  • Token portability is the whole selling point yet leaving VGS means migrating tokens back out, a project the vendor has no incentive to streamline, so the lock-in you removed from your acquirer partly moves to VGS.
  • Entry pricing at around one thousand US dollars a month is real money for a pre-revenue fintech, and it buys volume-limited throughput, so cost scales with exactly the growth that made you buy it.
  • Scope reduction is not scope elimination: your QSA still assesses how you integrate, and teams regularly discover that a support tool or an internal admin screen pulled plaintext back in and dragged systems into scope again.
  • Proxy-based interception constrains how you design request flows, and non-standard payloads, streaming uploads or binary formats often need custom routing rules that make debugging production issues noticeably harder.

Pricing, plan by plan

Basis Theory

$995/month
  • Starter$995/month
    • 20,000 tokens included
    • Production PCI Level 1 environment
    • US region only
  • Scale$undefined/month
    • Quoted
    • Higher token volumes
    • Additional regions
  • Enterprise$undefined/month
    • Quoted
    • Additional compliance options for PII and PHI
    • Responses for 95 percent of PCI SAQ D

Very Good Security

$1000/month
  • Starter$1000/month
    • Aliasing proxy
    • Vault storage
    • PCI scope reduction
  • Growth$undefined/month
    • Network tokenisation
    • Multiple processors
    • Data residency options
  • Enterprise$undefined/year
    • Custom vault architecture
    • Dedicated support and SLA
    • Contractual compliance coverage

Which should you pick?

Choose Basis Theory if

  • You need tokenisation api.
  • You work on Web, iOS, Android, Linux.
  • You also want hosted elements.
Basis Theory review

Choose Very Good Security if

  • You need aliasing proxy.
  • You work on Web, API.
  • You also want pci scope reduction.
Very Good Security review

Questions people ask

Is Basis Theory or Very Good Security better?
Neither clearly leads. Basis Theory starts at $995/month and Very Good Security at $1000/month, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Basis Theory or Very Good Security?
Basis Theory starts at $995/month and Very Good Security at $1000/month.
Does Basis Theory or Very Good Security run on more platforms?
Basis Theory runs on Web, iOS, Android, Linux. Very Good Security runs on Web, API.
What is Basis Theory best used for?
Basis Theory is most often used for a payments company that wants card on file without bringing its own infrastructure into pci scope and paying for the assessment that follows, a merchant locked into a processor by that processor vault that wants to hold its own tokens and route to more than one acquirer, a fintech collecting bank account and identity data that needs it isolated from its application database before an enterprise security review, a team that needs to send stored card data to a third party for a one-off integration without that data traversing its own servers. Of those, a payments company that wants card on file without bringing its own infrastructure into pci scope and paying for the assessment that follows and a merchant locked into a processor by that processor vault that wants to hold its own tokens and route to more than one acquirer are not what Very Good Security is typically brought in for.
What can Basis Theory do that Very Good Security cannot?
Basis Theory covers Tokenisation API, Hosted elements, Outbound proxy, PCI attestation of compliance. Very Good Security covers Aliasing proxy, PCI scope reduction, Network tokenisation, Processor optionality.

Answered from the vendors’ own pages

Basis Theory: Does this make us PCI compliant?

It removes cardholder data from your systems and gives you an AOC plus documented responses for most of a SAQ D. Your assessor still determines your scope, and a careless integration can pull systems back in.

Very Good Security: Does VGS make me PCI compliant?

No. It removes cardholder data from your systems so your assessment covers a far smaller boundary, but you still complete an assessment and your integration is part of it.

Basis Theory: What does it cost to start?

995 US dollars a month on Starter, including 20,000 tokens, a production PCI Level 1 environment and US hosting. Higher tiers are quoted.

Very Good Security: Can I move to another processor without re-collecting cards?

Yes, that is a core reason people buy it. The vault reveals stored credentials to whichever processor you route to.

Basis Theory: Can we switch payment processors without re-collecting cards?

Yes, that is the main non-compliance reason to buy it. You hold the tokens and detokenise into whichever processor you route to.

Very Good Security: What does it cost?

Published entry pricing is about one thousand US dollars per month; growth and enterprise tiers are quoted.

Basis Theory: Is data stored outside the United States?

Not on Starter, which is US only. Other regions require a Scale or Enterprise agreement.

Very Good Security: Is it only for card data?

No. The proxy handles any sensitive field, including bank details, national identifiers and documents, though payments is where the product is now focused.

Share

Related pages

More on Basis Theory

More on Very Good Security

Keep looking

Other head to heads