Payment processor that lets me move my customers' stored card details to another provider if I leave

Yes. If you want a payment processor, Braintree is one option: it says it supports importing and exporting customer/card records at no charge, with a secure transfer to a PCI-compliant provider. The catch: subscriptions and transaction history don’t migrate automatically, and Apple Pay/Google Pay credentials aren’t transferable. (developer.paypal.com)

If being able to switch processors easily is your top priority, consider keeping the card vault separate from the processor. Spreedly is a vault/orchestration service—not a processor—and supports moving payment data to another PCI-compliant provider. Its manual exports may take about two weeks; extra exports can cost money. (support.spreedly.com)

Before signing, get written answers to: Can you export the actual card details—not just provider-specific tokens? What does it cost and how long does it take? Can the next provider import them? Do subscriptions and billing schedules move too? Card portability doesn’t necessarily mean subscriptions move with the cards.

Several major processors will move stored cards for you, but the feature is conditional, so check it before you sign anything.

How it works: The move is a processor-to-processor card data export, not a download to you. The encrypted card data transfers directly between the two vaults, and your new processor re-vaults the data and issues new tokens. Your own systems then swap old token IDs for new ones using a mapping file.

Which providers do it (as of recent sources):

• Stripe: It sends an encrypted JSON file with card details, customer email addresses and any metadata you attached. It does not export payment history, subscriptions or other objects, and it excludes every card saved through Link.
• Braintree: It says it does not charge any fees for data migrations. It allows no more than two exports, and Apple Pay and Google Pay payment methods are excluded.
• Adyen: It says it "will of course comply" because you own the data, and asks to plan the move in advance.
• Helcim, Square, Authorize.net: Helcim exports only to a Level 1 provider and asks you for its Attestation of Compliance. Square uses the same Level 1 requirement.

Conditions that catch people out:

• The receiving processor must be PCI DSS Level 1. Stripe, for example, won't begin an export until you have selected and contracted with a compliant receiving processor.
• Subscriptions don't come with the cards. An export carries card details, not your subscription logic. You must rebuild plans, billing dates and customer mappings in the new system.
• Timing varies. One source estimates about 10 business days, while another says the export typically takes 4-12 weeks of coordinated work. Treat both as rough.
• Digital wallets are a separate issue. Apple Pay, Google Pay and PayPal billing agreements generally don't move through the card vault.

If you want to avoid lock-in entirely: Consider an independent vault (such as VGS, Basis Theory or Skyflow) rather than a processor-owned vault. One source notes that with an independent vault, you can switch processors, or route different transactions to different providers, without ever running a migration again. The trade-off is more setup effort and a vault provider to pay.

Before you choose a processor: Get the portability terms in writing. Ask whether the export is included in the contract, what fees apply, how many exports are allowed, and whether it covers the card type you use most. One source advises writing data portability terms into every processor or gateway contract before you sign.

If you tell me which processor you're considering, or whether you use subscriptions or a platform like Shopify, I can narrow this down. Processor terms change, so confirm the current policy directly with the provider.

To address your concern about moving stored customer card details, it is important to first distinguish between tokens and card data.

The Core Reality: You Cannot Move "Tokens"

It is a common misconception that you can move your existing payment "tokens" from one processor to another. You cannot.

• A token is simply a unique reference ID created by your current processor; it is meaningless outside of their specific system.
• If you move to a new provider, they will have to generate their own new tokens for your customers.

How You Actually Move (The "Migration" Process)

While you cannot move the tokens, you can move the underlying card data (the actual card numbers, expiration dates, and cardholder names) in a secure, PCI-compliant process known as a token vault migration (or data export).

1. Direct Provider-to-Provider Transfer: You do not handle this data yourself. Your current processor will securely transfer the encrypted card data directly to your new, PCI-compliant processor.
2. The New Provider Re-tokenizes: Once the new processor receives and decrypts the data, they store it in their own vault and issue you a new set of tokens.
3. Mapping: You will receive a "mapping file" from the new provider that links your old token IDs to the new ones, allowing you to update your database so your subscriptions continue uninterrupted.

Choosing the Right Path

Depending on your business needs, you have two primary strategies for managing this:

Strategy 1: Processor-Native Vault (Common)

Most major processors (like Stripe, Square, and Helcim) will allow you to export your customer card data to another PCI DSS Level 1-compliant processor upon request.

• Pros: Easy to set up initially; no extra third-party costs.
• Cons: You are reliant on your current processor's cooperation and timelines, which can take several weeks. You are effectively "locked in" until you perform a migration.

Strategy 2: Independent Vault (Flexible)

If you want to avoid future vendor lock-in entirely, consider using an independent, third-party payment vault (e.g., Basis Theory, Spreedly, or similar).

• How it works: Instead of storing cards with your payment processor, you store them in this independent vault. You then "route" payments through whichever processor you choose.
• Pros: You own the data. If you decide to switch processors, you simply point your vault to the new provider. You are not dependent on your old processor’s willingness to export your data.
• Cons: This requires more intentional, upfront technical work to integrate your systems with both the vault and the payment gateway.

Critical Considerations Before You Switch

• PCI Compliance: Your new provider must be a PCI DSS Level 1-compliant service provider to accept an import of card data.
• What Does NOT Move: Subscriptions, payment history, and "wallet" credentials (like Apple Pay, Google Pay, or Stripe Link) typically do not move. You will need to export your subscription schedules separately and rebuild them in your new system.
• Don't Close Too Early: Always keep your old processor account active for at least one full billing cycle after the switch to handle any disputes, refunds, or delayed processing that may occur.

Recommendation: If you are a high-volume merchant or anticipate changing processors in the future, evaluate an independent vault to decouple your data from your processor. If you are a smaller business, stick with a reputable processor that explicitly documents a "data export" or "PCI-compliant migration" policy (such as Stripe or Square) and ensure you have that process clearly outlined in your agreement before you scale.

Look for card-vault portability or PCI-to-PCI vault migration—not just “saved cards” or tokenization. Most processors’ ordinary card tokens only work within that processor, but some can securely transfer the underlying card details to another compliant provider, which then creates new tokens.

Options to investigate:

• Adyen documents importing stored card details from another provider, subject to the old provider’s cooperation and the receiving provider’s compliance requirements. ¹
• Stripe supports card-data exports to another PCI DSS Level 1 processor; the receiving provider must be eligible to accept the transfer. ²
• Braintree supports vault exports, though its documentation and migration limits should be checked for your specific use case. ²

Before signing, get written answers to: Can you export my stored card credentials to a different PCI-compliant processor if I leave? What fees, timing, and format apply? Do subscriptions and wallet payments transfer too? A card-data migration generally does not automatically move subscription settings, transaction history, or Apple Pay/Google Pay credentials. ¹²

If portability is a top priority, consider an independent payment vault that can connect to multiple processors, rather than relying on one provider’s vault. ¹⁰