Customer Credit Card Number Tokenization
We encrypt the customer credit card numbers at the database level and mask the numbers except the last 4 digits on the application screens. In an attempt to make it more PCI compliant, we are exploring the options of tokenizing the credit card numbers, i.e. only storing symbolic tokens within E-Business Suite; the real credit card numbers for these tokens are stored in a "card vault" of a 3rd party application. (this 3rd party application has been certified to be fully PCI compliant).
Has anyone had any experience doing something similar? If so, would you mind sharing your experience?