Where your card stops
- Card number
- Held by the processor
- On our systems
- A token only
- Sent to the operator
- Airtime, no card data
Your card number never rests with us
VirtualPhone runs on PCI-DSS Level 1. That is the strictest tier of the card industry's security standard. It is checked by an outside assessor, not by us.
You send airtime to a phone abroad. Your card details should not travel any further than the bank. On this page we show exactly where they stop.
What Level 1 actually asks for
The standard has four levels. Level 1 sits at the top and takes the hardest route. Three things set it apart.
-
The top tier of the standard
PCI-DSS is the card industry's rulebook for handling payments. Level 1 is its highest tier. It carries the heaviest checks of the four.
-
Checked from the outside
Level 1 is not a self-graded form. An outside assessor reviews the controls and signs off each year. Nobody marks their own homework.
-
Re-tested through the year
The sign-off is not the end of it. Networks are scanned on a set schedule. Findings get fixed and then re-tested.
Encryption is the other half of the story. See how we encrypt and handle data .
One payment, step by step
A top-up looks like one tap. Underneath it is four short moves. Your card number takes part in the first one only.
After that we work with a token. So a break-in on our side has no card number to find.
See which operators we reach directly- Card entered
- Details go straight to the payment processor over an encrypted link.
- Card swapped for a token
- We keep a token, not a number. A token buys nothing anywhere else.
- Payment approved
- Your bank makes the call. We only ever see the yes or the no.
- Top-up sent
- The airtime request leaves for the operator. It lands in seconds.
The control areas we are measured on
The standard groups its rules into six broad areas. Each one is a check an assessor can ask us to prove.
-
Network defence
Traffic is filtered at the edge. The payment path is walled off from the rest of the estate.
-
No default passwords
Vendor defaults are removed before anything goes live. Every system gets its own credentials.
-
Data at rest
We hold tokens and receipts. Raw card numbers are never written to our own storage.
-
Data in transit
Card and account traffic is encrypted end to end. Plain-text card data never crosses a public link.
-
Access control
Staff get the least access their job needs. Every account is unique, so actions trace back to a person.
-
Watch and test
Logs are kept and reviewed. Systems are scanned and tested on a schedule, not on a hunch.
Security shapes the price too. Nothing here is paid for with a hidden line — read the full pricing breakdown.
Card safety, answered
Four questions people ask before they send the first top-up.
Does VirtualPhone store my card number?
No. We hold a token issued by the payment processor. The raw number is not written to our systems.
What is a token, in plain words?
It is a stand-in code for your card. It works for your next top-up here. It is useless to anyone else.
Is my saved card safe for Auto Top-Up?
Yes. A repeat recharge runs on the same token. Nothing extra about your card is stored to schedule it.
Does Level 1 cover my personal data too?
Not on its own. The card standard covers payments. Personal data is handled under our privacy rules.
Want the data side in full? Read our privacy rules, or set up a repeat recharge on the same protected token.
Send it safely. Send it now.
Pick a number and a country. The card work happens behind a Level 1 wall. The airtime lands in seconds.