Own your card data.
Cut PCI to SAQ A.

01Today’s Agenda

Built around the agenda your team set - each block has a dedicated Basis Theory owner in the room.

02Basis Theory Overview

The unified card-vaulting & tokenization platform. Basis Theory is a secure card-data environment: you collect card data from any source and route it to any destination - PSP, network, or partner. You keep full ownership, utility, and flexibility of the data, without the overhead and compliance scope of persisting it yourself.

For Dow Jones specifically: your subscriptions run on Chase Paymentech & American Express today, with card data vaulted in-house. Basis Theory externalizes that vault into an independently audited PCI DSS Level 1 environment - your merchant relationships stay exactly where they are, your PCI scope drops to SAQ A, and adding a local acquirer in a new market later becomes a routing decision instead of a re-integration. The same vault runs Network Tokens, Account Updater, and 3DS once, shared across every processor you ever use.

Your RFP goals, mapped to the platform

03Reference Customers

04The Integration: Elements & Proxy

• User controls, built in. Granular RBAC scopes every user and application to least privilege; Okta SSO (SAML) governs portal access; detokenization is disabled by default and permissioned per role; every reveal is logged with identity, timestamp, and action. (Reqs 4.4, 5.10 - 5.13)
• Real-time dashboards & reporting. Token utilization & reconciliation, vault activity, API request/response logs, proxy visibility, and integration performance - live in the portal, downloadable as CSV / flat file, schedulable or on demand, and available over API, with SIEM streaming into your Splunk-class tooling. Transaction-level performance visualization rides on the Pagos partnership in section 06. (Reqs 3.15, 3.22, 4.1, 4.2, 4.6, 5.14)
• BIN intelligence on every card. Issuer, brand, funding type, country, product type, and L2/L3 capability - returned out of the box, and yours to persist locally with no PCI implications. (Reqs 2.4 - 2.6)
• Lifecycle events, twice over. Signed webhooks for every token lifecycle event plus an inquiry API for reconciliation and recovery, so a missed webhook is never a lost update. (Reqs 1.3, 4.9)

Phone payments: descope the IVR with the inbound Proxy

For card payments taken over the phone, the same Proxy runs in reverse. Your IVR platform posts its payload - raw PAN included - to a Basis Theory inbound Proxy endpoint; a request transform tokenizes the PAN in flight; and your backend receives the identical payload with a token where the card number used to be. Card verification runs as a separate API flow through the same Proxy to Chase. The caller experience doesn't change, and cardholder data never reaches Dow Jones backend systems.

Scope note: Dow Jones systems descope to SAQ A - the IVR vendor retains its own PCI obligations for the DTMF capture, and your QSA will want the vendor's AOC alongside ours. Send us the IVR vendor and setup details and we'll map this pattern to your exact stack.

05Network Tokens, Built for Acceptance

Processor-agnostic by architecture, not by promise. Network tokens are provisioned under Dow Jones’ own token requester ID through our direct network connectivity - so they work with Chase Paymentech and Amex today, any processor tomorrow, and they leave with you if you ever go. Basis Theory is transparent to the card networks: no Basis Theory identifier is tied to your transactions.

• All your brands. Visa, Mastercard, American Express & Discover Network Tokens are live today with active customers. JCB is next on our committed roadmap, with UnionPay & RuPay following on a 3-month lead time - and in the meantime JCB cards vault and route through the Proxy like every other card. (Req 1.5)
• Where the lift comes from: trust. A Network Token is issuer-provisioned, carries a cryptogram, and its provisioning is verified - so issuers approve it in a way they cannot approve a raw PAN. For a subscription business, that directly means fewer false suspected-fraud declines, the biggest silent revenue leak in recurring billing.
• Durable across reissue. Network tokens survive card expiration, reissue, and loss, with lifecycle updates flowing from the issuer - a subscription keeps charging through events that would kill a stored PAN. (Req 1.8)
• The vault never blinks. When an issuer does not support Network Tokens, or a token service degrades, the raw PAN path through the Proxy keeps every transaction flowing - with batch Account Updater on all four networks and real-time on Visa & Mastercard keeping stored PANs fresh. (Reqs 2.1, 2.9)
• One card, one identity. Card fingerprinting gives you a stable, PCI-free identity value to recognize the same card across tokens and brands. (Req 2.11)
• Card-mix analysis. Send us the card mix by region that we discussed in January and we will return projected Network Token coverage for Dow Jones’ actual portfolio before your decision is final.

06Orchestration, Direct Through the Proxy

The RFP asks for cost-optimized and net-revenue-optimized routing, so let’s address it head on: Basis Theory is deliberately not another gateway or orchestration vendor sitting between you and your processors. You orchestrate through us - your own routing rules, executed through the Proxy, against your own direct processor relationships.

How Dow Jones routes through Basis Theory

• Your rules, our rails. Every vaulted card carries full BIN intelligence - issuer, issuing country, brand, funding type, product type, L2/L3 capability. Your billing layer applies BIN-based routing rules - least-cost by scheme fees and acquirer pricing, or net-revenue by historical approval performance per BIN and issuer - and the Proxy delivers each charge to the acquirer you chose. (Reqs 3.5, 3.6, 3.23)
• Failover without drama. If a transaction fails or an acquirer degrades, retry down the secondary route through the same Proxy - the vaulted credential and its Network Token work everywhere they need to. (Req 3.24)
• Native payloads, preserved. No normalized gateway schema means every Chase Paymentech and Amex capability stays available exactly as their documentation describes it, including Level 2/3 data. Adding a local acquirer later is a routing decision, not a re-integration. (Req 3.8)

Going direct vs. an orchestration vendor

07Never Miss a Payment

Never miss a payment → increase auth rates

• Processor tokens - get processor tokens back for multiple acquirers at initial capture, then try them across processors on later charges.
• Network tokens - processor-agnostic credentials, safe to store in your own database with no PCI scope, so Basis Theory is never a point of failure for a renewal.
• PAN + NT TX ID fallback - call the processor directly through the Proxy with the PAN plus the Network Transaction ID; you rarely need to re-collect CVV. Account Updater keeps the PAN fresh underneath.

Never insult the subscriber → conversion & churn

Because you never prompt a reader to re-enter a card, you see higher retention and less involuntary churn - the renewal simply works, through card reissue, expiration, and even a processor outage.

What is the Network Transaction ID? A unique identifier the card networks assign to a transaction. Storing it lets you link merchant-initiated charges to the original customer-initiated one, reroute to another acquirer without recollecting CVV, improve authorization rates, and stay compliant with network stored-credential rules. Alt terms: TxID, Scheme Transaction ID, Network Reference Number, ARN, Authorization ID.

Your processors return it on the authorization response - start storing it from day one (illustrative):

// authorization response
{
  "approved": true,
  "transaction_id": "7614512358310542",
  "card": {
    "network_transaction_id": "8723dfab9c4e56a1b8cd0291ef67ac43"
  }
}

08Implementation: SAQ D → SAQ A-EP → SAQ A in ~12 Weeks

1. Stage 0 · SAQ D today - quick wins in weeks 1-3. Tenant setup with Okta SSO & RBAC lands in week one. Server-side vaulting goes in behind your existing hosted form (2-3 wks) - no frontend change - and backend charges route through the Proxy to Chase Orbital & Amex with your exact processor payloads preserved. Network tokens (1-2 wks) & Account Updater webhooks (1-2 wks) provision concurrently on the vaulted cards, and your in-house vault bulk-imports in parallel. One honest dependency: browser-based 3DS stays awkward while capture is server-side - it unblocks in stage 1.
2. Stage 1 · SAQ A-EP - transitional, ~6-8 weeks end to end (overlapping stage 0's tail). Your checkout form fields are rewired to post card data directly to the Basis Theory vault (4-6 wks), bypassing the Dow Jones backend entirely - no PAN stored or handled in-house. The standard browser JS 3DS challenge ships here (3-4 wks), and every new card captured is already provisioning Network Tokens.
3. Stage 2 · SAQ A - target, live around week 12. Swap the form fields for full Elements iframe capture (4-5 wks) so your page never touches cardholder data - with Apple Pay & Google Pay supported, plus Elements dual-write fallbacks for no single point of failure. 3DS goes Elements-native (3-4 wks, no separate challenge integration), Account Updater runs vault-level with no per-PSP fees, and Network Tokens finish as the durable, issuer-side credential. Canary the cutover on net-new volume and monitor auth rates against baseline.

Straight talk your QSA will appreciate: each stage reduces the systems and network segments subject to PCI DSS assessment - no stage eliminates PCI applicability entirely. Dow Jones remains a PCI-assessed merchant at every stage, and SAQ A still carries an annual self-assessment and quarterly ASV scans. Timelines reflect typical Basis Theory implementation scope, not a contractual SLA, and are confirmed during scoping.

• Throughput & latency. 500+ tokenization requests per minute is comfortably inside normal operating range - the platform sustains 10,000+ RPS with sub-second p99 on every path. (Req 4.5)
• Availability. Active/active across regions and availability zones; historically above 99.999% API availability, with enterprise SLAs to 99.99%. Public status page with component-level history and incident RCAs. (Reqs 4.3, 4.8)
• Reliable APIs. Idempotent mutations and request-outcome discovery, so a dropped response is never an unknown state. (Reqs 4.12, 4.13)
• Multi-acquirer future, de-risked. When you add a local acquirer in a new market, the vault, tokens, and integration do not move - it is a routing decision, informed by the BIN and performance data you already hold.

09Security & SAQ A Scoping

SAQ A is the lowest-scope PCI questionnaire, and it applies when collection, storage, processing, and transmission are fully outsourced - raw PANs never touch Dow Jones systems. Two components achieve this:

Basis Theory’s Compliance team pre-fills roughly 95% of the SAQ based on your implementation. Basis Theory reduces PCI scope - it does not eliminate it - and Dow Jones’ acquiring bank or QSA always makes the final determination. We support that assessment with documentation, evidence, and direct participation in audit discussions. (Req 5.6)

What Dow Jones owns under SAQ A - the shared responsibility split

The full PCI DSS v4.0.1 Shared Responsibility Matrix in your RFP package defines the control-by-control split, and it maps stage by stage to the implementation roadmap in section 08. In summary - SAQ A still carries an annual self-assessment and quarterly ASV scans, and three items stay with Dow Jones:

PCI DSS v4 payment-page controls handled by Basis Theory

The platform underneath

HSM-backed key management with automated and manual rotation; AES-256 at rest, TLS 1.2+ in transit; comprehensive audit logging of token creation, access, detokenization, and admin actions; SIEM integration via API, streams, and log export. Your AOC and PCI v4.0.1 Shared Responsibility Matrix are already in your RFP package, and everything else lives in our Trust Center. (Reqs 5.7 - 5.16)

10AI Features

Two ways AI shows up in this platform - one for your payments roadmap, one for how your teams build.

Agentic commerce readiness

AI agents are starting to buy subscriptions and content on behalf of users, and the ecosystem has not picked a winner: Visa Intelligent Commerce, Mastercard Agent Pay, Stripe Shared Payment Tokens, and open protocols like x402 are all in flight. Your vault should not force a bet. Basis Theory’s agentic layer turns any vaulted credential into whatever rail the transaction in front of it requires - scoped, allowance-limited credentials with server-side spend enforcement - so when an agent shows up to buy a WSJ subscription, Dow Jones is ready without a new integration. Explore the agentic docs.

AI-safe data handling

As Dow Jones builds with LLMs, the vault keeps sensitive data out of the blast radius: tokenize before data reaches a model, keep raw values out of prompts, context windows, and traces, and detokenize only at the policy-approved edge. Cryptographic fingerprinting lets your teams dedupe, join, and analyze tokenized data without ever detokenizing it - analytics without exposure.

11Data Portability & Exit

• Full export on request - tokens, PAN data, token-to-PAN mappings, metadata, and schema documentation, delivered encrypted (PGP / secure API / mutually authenticated channel) within 5 business days. The process is publicly documented - migrating off Basis Theory is a supported, first-class workflow. (Reqs 6.2 - 6.5)
• 30-day post-termination access to support migration and validation, followed by secure deletion with written certification of destruction. (Reqs 6.10 - 6.13)
• Portability is also leverage on day one. Because your entire portfolio can be bulk-imported with essentially no engineering work, Basis Theory acts as a card escrow - the moment your cards are portable, your negotiating position with every downstream provider changes.

12Why Basis Theory

13How to Think About ROI

At a high level, the value shows up in four places - the same levers we model for other enterprise subscription businesses:

• Improve acceptance rates. Network tokens alone: the networks quote a 5-9% lift in overall success rates, and our customers now broadly match that - results have strengthened materially over the last 18-24 months as issuer-side coverage matured. The lift comes from trust: an issuer-provisioned credential with a cryptogram narrows the issuer’s fraud lens, which for recurring billing directly means fewer false suspected-fraud declines, the biggest silent revenue leak in subscriptions. Layer BIN-based routing, the Network Transaction ID strategy, and Account Updater on top and enterprise customers typically see a 10-25% approval lift overall.
• Eliminate PCI cost. Operating an in-house cardholder data environment typically runs $500K-$750K+ per year plus staff time for audit evidence. That burden shifts to Basis Theory (PCI Level 1), and Dow Jones drops to SAQ A.
• Streamline payment operations. Run Network Tokens, Account Updater & 3DS once at the vault and share them across Chase Paymentech, Amex, and every future acquirer - 50%+ savings vs. per-processor services, and no duplicate provisioning of the same card.
• Never miss a payment. Dual-write and fallback paths protect renewal revenue during any provider outage - yours, ours, or theirs.

14Pricing

Card enrichment add-ons are billed at cost from the networks, monthly in arrears on actual usage. Your total cost is known on day one and does not move with your growth.

15Your Dedicated Team

Training, documentation & ongoing support

• Training for technical & business users. Hands-on developer onboarding led by Dustin and our Forward Deployed Engineering team through the 12-week implementation, plus portal training for your billing, finance & compliance users - all included, at no fee.
• Documentation. A complete API reference, integration guides, and migration runbooks at developers.basistheory.com - the same docs linked step by step in section 08.
• Ongoing support structure. Tyler as your named Technical Account Manager, a shared Slack channel with our engineers, in-portal support, and a public status page with component-level history and incident RCAs - with escalation paths straight to engineering and enterprise support SLAs formalized in the MSA.