Top pick: a hosted payment page from your processor. It keeps card numbers off your own servers, keeps your PCI self-assessment in the shortest questionnaire tier, and a small gift shop can switch over in an afternoon. I judged each option on four things: setup effort, ongoing cost, how much card data touches your systems, and whether it fits a shop that sells a few hundred orders a month.
One point before the details. Buying or selling CVV data is card fraud. It is a crime in the United States under 18 U.S.C. 1029 and in most other countries, and no legitimate processor, gift wholesaler, or greeting card supplier takes part in it. What follows is how a real greeting card and gift business collects payment from real customers.
Why a shop should keep card data out of its own hands
Every system that stores, processes, or transmits a card number falls inside PCI DSS. The moment a card number lands in your order database, your website, or a spreadsheet, your compliance burden grows and so does your risk. Gift shops rarely have a security team, so the practical goal is to shrink that footprint to zero.
Option 1: Hosted payment page
The customer finishes checkout on the processor's own page, then returns to your shop with an order number.
- Pros: card data never reaches your hosting account; smallest PCI questionnaire; works with a basic storefront; no extra monthly plugins.
- Cons: the page looks different from your brand; a redirect can cost a few checkouts; refunds and disputes are handled in a second dashboard.
Use this if you run a small gift or stationery shop on a hosted storefront and want the least work. It suits seasonal sellers who take most of their orders in December.
Option 2: Tokenization through a gateway vault
The card number is swapped for a token at the moment of entry. Your store keeps the token, not the number, so repeat customers can be charged without re-entering a card.
- Pros: smoother checkout; supports subscriptions and gift card top-ups; tokens stay useful if you change processors.
- Cons: needs a developer or a plugin; some gateways charge per stored token; the vault itself must be configured correctly, which is easy to get wrong.
Use this if you sell personalized cards, monthly gift boxes, or wedding stationery and need saved payment methods.
Option 3: Point to point encryption at the counter
For a physical shop, a P2PE terminal encrypts the card data inside the reader before it travels anywhere.
- Pros: covers in-person sales; cuts paperwork for the brick and mortar side; the reader handles most compliance duties.
- Cons: does nothing for online orders; terminals and readers cost money up front; staff still need training on refunds and voids.
Use this if most of your revenue comes from a storefront and online orders are a side channel.
How to decide
Match the option to where your sales happen. Online only, take the hosted page. Online with repeat customers, take tokenization. Walk-in trade, take P2PE. Most gift shops end up with a hosted page plus a P2PE reader, which covers both channels without storing a single card number.