The safest card record is the smallest one. For most people, the issuer’s name, its support contact and the last four digits are enough to identify a card and report it. Keep those in an encrypted vault, never store a PIN or security code, and use your bank’s app or a payment wallet for actual payments.
What card details is it reasonable to keep?
The issuer’s name, its support phone number, the last four digits and redacted statements. That is usually enough to identify a card and report it if it goes missing. Redact unnecessary numbers on statements before you save them.
What should you never store?
The PIN. The security code (CVV/CVC) alongside the card number. A full, unredacted photo of the front and back together.
Under PCI DSS, merchants are restricted from retaining verification codes after authorization. A personal record has no reason to keep one either.
Why is a photo of your card risky?
The front and back together reveal the full number, expiry and security code in one image. In a camera roll, that image has the same exposure as any other photo: it appears when you scroll, it can be uploaded by an automatic photo backup, it can be read by apps with photo-library access, and it lingers in recently deleted.
Encryption protects a saved file; saving less reduces what could be exposed.
Step by step: how do I store card details safely?
1. Decide on the smallest useful record.
2. Redact numbers on statements before importing them.
3. Import into a vault folder, for example “Cards”. The folder name is encrypted.
4. Save the recovery key separately and keep an encrypted backup.
5. Delete the original photos and screenshots. Importing does not remove them.
Where does a vault fit, and where does your bank fit?
A vault is for records. Your bank or wallet is for payments and fraud protection. Revault does not tokenize cards, make payments or replace your issuer’s fraud controls.
What should I do if my phone or wallet is lost?
Contact your card issuer first. The support number in your vault is why you saved it. On a new device, restore the vault with your recovery key and your encrypted cloud copy or backup. If you think the vault’s keys were exposed, move the records to a new vault.
How does Revault protect these records, and what can’t it do?
Records are encrypted on your device before they are stored. The vault has a random 256-bit AES-GCM master key. Your pattern and a random device secret, run through PBKDF2-HMAC-SHA-256 with 600,000 iterations, protect that key. Files, filenames and thumbnails are all encrypted. The native iOS and Android apps keep vaults on-device unless you turn on private iCloud or Google Drive sync, create a share or export. The web app uses a passkey account and Revault’s cloud.
What it can’t hide: the service can see that an object of a certain size exists, and when it was stored. A compromised device can read an unlocked vault. Revault has not had an independent security audit.
Common questions
Is Revault PCI compliant? It is a personal vault, not a payment processor, and makes no PCI compliance claim.
Can I pay with cards saved in Revault? No. Use your bank’s app or a supported payment wallet.
Is it safe to keep a CVV in a notes app? Avoid storing it at all.