Basis Theory

Developer tokenisation platform that holds card and sensitive data inside a PCI Level 1 environment you do not operate

As of 31 August 2026, Basis Theory starts at $995/month. Basis Theory tokenises card numbers, bank details and personal data so your systems never store the raw values, and hands you an attestation of compliance covering most of a PCI SAQ D. Softwr lists it under APIs. Basis Theory is made by Basis Theory, Inc., available on Web, iOS, Android, Linux.

Visit siteVisit Basis Theory

Overview

What Basis Theory does

Basis Theory is a tokenisation and data vault API. Sensitive values are collected through hosted elements or sent to the API, stored inside a PCI Level 1 certified environment run by Basis Theory, and returned to you as tokens. You can then use those tokens in outbound requests through a proxy, so a card number can be sent to a payment processor without ever passing through your own servers. The same mechanism is offered for personal and health data. The commercial argument is scope reduction, and it is a real one. If cardholder data never touches your infrastructure, the systems handling tokens fall outside most of your PCI assessment, and Basis Theory provides an attestation of compliance and documented responses covering a large share of the PCI SAQ D questions. For a company that would otherwise spend a year and a consultant budget bringing its own environment into scope, that is the whole deal. The second argument is processor independence: because you hold the tokens rather than a payment provider, you can route the same stored card to a different processor without a card data migration, which is what makes multi-processor routing and processor switching practical. Buyers are payments companies, marketplaces and fintechs with card-on-file requirements, plus companies that got locked into one processor by their vault and want out. Published pricing starts at 995 US dollars a month for Starter, which includes 20,000 tokens and a production PCI environment in the US only; Scale and Enterprise are quoted. The trade-off is that you are moving your most sensitive data into a vendor dependency, and getting it back out is a card data migration with all the assessor involvement that implies.

What people use it for

A payments company that wants card on file without bringing its own infrastructure into PCI scope and paying for the assessment that follows
A merchant locked into a processor by that processor vault that wants to hold its own tokens and route to more than one acquirer
A fintech collecting bank account and identity data that needs it isolated from its application database before an enterprise security review
A team that needs to send stored card data to a third party for a one-off integration without that data traversing its own servers

Where it falls short

Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Basis Theory.

The Starter plan is 995 US dollars a month before any volume, which is a real floor for an early stage company and puts the product out of reach of teams tokenising a few thousand records.
Starter is limited to the US region, so a company with European data residency requirements is pushed into a quoted Scale or Enterprise agreement immediately.
Log retention on Starter is 24 hours, which is well below what most security teams expect for a system holding cardholder data and forces an upgrade for reasons unrelated to volume.
Migrating away means moving card data out of the vault, which requires processor and assessor involvement and is slow, so the portability argument that attracts buyers cuts against them at exit.
An attestation of compliance covers the vendor environment, not your assessment; your assessor still decides what is in scope, and buyers occasionally discover their integration pattern pulled systems back into scope anyway.

Cross-shopped

What people choose instead of Basis Theory

Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.

Basis Theoryvs
Very Good Security
Very Good Security: Similar scope reduction model with a longer track record and a network-level proxy approach
Basis Theoryvs
Skyflow
Skyflow: Broader privacy vault covering PII and PHI as first class rather than as an enterprise add-on
Basis Theoryvs
Stripe
Stripe: If you are happy to stay on one processor, its vault costs nothing extra but locks the cards to Stripe
Basis Theoryvs
HashiCorp Vault
HashiCorp Vault: Self-managed and far cheaper in licence terms, but you keep the data and therefore keep the PCI scope

Pricing

What Basis Theory costs

Taken from the vendor's own pricing page. Prices move, so check before you buy.

Starter

$995 /mo

20,000 tokens included
Production PCI Level 1 environment
US region only
1MB payload limit
24 hours of logs
PCI attestation of compliance

Scale

On request

Quoted
Higher token volumes
Additional regions

Enterprise

On request

Quoted
Additional compliance options for PII and PHI
Responses for 95 percent of PCI SAQ D
Unlimited monthly interactions per token
Custom log retention and payload size
Uptime guarantees

Capabilities

Features

Tokenisation API
Exchanges card, bank and personal data for tokens stored in a PCI Level 1 environment
Hosted elements
Browser and mobile input components so raw values never touch your frontend or servers
Outbound proxy
Detokenises into requests to processors and third parties without exposing values to your systems
PCI attestation of compliance
Provides an AOC and documented responses covering most of a PCI SAQ D questionnaire
Processor portability
Tokens are yours, so the same stored card can be routed to a different processor without migrating card data
Reactors
Runs code against detokenised values inside the secure environment for custom integrations
Access controls and audit
Fine-grained permissions on which applications may detokenise which fields, with access logging
PII and PHI options
Additional compliance handling for personal and health data on enterprise agreements

Answered, with sources

Questions people ask

Each answer names the page it came from, so you can check it rather than take our word for it.

Does this make us PCI compliant?

It removes cardholder data from your systems and gives you an AOC plus documented responses for most of a SAQ D. Your assessor still determines your scope, and a careless integration can pull systems back in.

What does it cost to start?

995 US dollars a month on Starter, including 20,000 tokens, a production PCI Level 1 environment and US hosting. Higher tiers are quoted.

Can we switch payment processors without re-collecting cards?

Yes, that is the main non-compliance reason to buy it. You hold the tokens and detokenise into whichever processor you route to.

Is data stored outside the United States?

Not on Starter, which is US only. Other regions require a Scale or Enterprise agreement.

Keep looking

Where to go from Basis Theory

Best APIs software for

Compare Basis Theory with

Other APIs software

Skyflow
Data privacy vault that holds sensitive records outside your own systems
Pricing on request12 researched notes
Increase
Direct banking API for ACH, wires, real-time payments, accounts and cards
Pricing on request12 researched notes
Lithic
API-first card issuing platform with direct Visa, Mastercard and Amex network connections
Pricing on request10 researched notes
Volt
Account-to-account pay by bank across Europe, the UK, Brazil and Australia
Pricing on request11 researched notes
Swan
European banking-as-a-service platform for embedding accounts, cards and payments into other products
Pricing on request10 researched notes
Moov
Payments API with a published rate card covering card acceptance, ACH and instant payouts
From $500/mo12 researched notes
Trustly
Pay-by-bank payments network, majority-owned by private equity firm Nordic Capital
Pricing on request10 researched notes
Vodeno
Banking-as-a-service platform running on a partner bank licence, backing NatWest's UK BaaS venture
Pricing on request10 researched notes
TrueLayer
Open banking payments and data across the UK and Europe, with the largest share of UK variable recurring payments
Pricing on request13 researched notes
Paymentology
Cloud issuer processing across emerging and developed markets
Pricing on request11 researched notes
Akoya
Bank-owned, token-based open finance network that replaces screen scraping for US financial data
Pricing on request11 researched notes
Sila
US money movement API for ACH, RTP and FedNow with KYC and ledgering built in
Pricing on request12 researched notes
Backbase
Digital and AI-native engagement banking platform for customer-facing banking experiences
Pricing on request10 researched notes
Enfuce
European issuer processor holding its own payment institution licence
Pricing on request11 researched notes
Griffin
UK banking-as-a-service from a company that holds its own full banking licence
From £100/mo11 researched notes
Stoplight
API design, documentation, and governance platform
Free, then $44/yr12 researched notes
Lithic
API-first card issuing platform with direct Visa, Mastercard and Amex network connections
Pricing on request10 researched notes
Swan
European banking-as-a-service platform for embedding accounts, cards and payments into other products
Pricing on request10 researched notes

Softwr does not host reviews and shows no star rating for Basis Theory, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.

Best APIs software alternatives

View all APIs software