Saved cards sit with your payment processor, not your software, and processors move them for a living. What the export contains, how long it takes, what never comes across, and the order to do it in.
Ask a room of storage owners why they are still on software they complain about and the answer is usually the saved cards. Moving them is a defined process with published rules: Stripe commits to a 10-day service level once it has your data, and Adyen tells merchants to budget 10 days or more. Neither charges the kind of ransom operators expect.
What trips people up is assuming the cards live in the software. They do not.
What happens to saved cards when you switch self storage software
Your management software stores a token, not a card number. The processor holds the number and hands back a stand-in value that only it can charge. Braintree describes the mapping directly: two identifiers, a customer ID and a payment method token, tie its records to yours.
That token is worthless to a different processor. So the real question is not which software you are moving to, it is which processor sits behind it, and whether your current one will release the data.
Ask your current vendor who processes the cards. If the answer is that payments are part of the software, ask who the processor behind it is, and write the name down.
The transfer is a documented process, not a favor
What the old processor sends
Stripe prepares an encrypted JSON file holding card data, customer email addresses and metadata, then arranges the transfer with whoever you are moving to. Braintree wants the same information as CSV in UTF-8 encoding and says other formats cause delays. The file goes between the two companies. It never lands on your desk.
How it travels
PGP encryption, over SFTP. Stripe requires the receiving processor's public key to be 4096 bits or longer and hosted over HTTPS on a domain that appears in that processor's Attestation of Compliance or its Visa Global Registry listing. It will only send card data to a PCI DSS Level 1 processor. Adyen asks for a data processing or data transfer agreement to be in place before anything moves, and asks you to request its PGP key from support.
These requirements are the reason the process takes days rather than minutes, and they are also your protection.
What it costs and how long it runs
Adyen states it does not charge for migrating payment data. Stripe publishes the 10-day service level mentioned above, timed from receiving everything valid, which means a missing field restarts your clock rather than theirs.
What does not come across
Cards and customers move. The rest does not, and Braintree says so in its own documentation: it cannot migrate subscription or transaction information.
That leaves four jobs on your side of the line.
- Autopay flags. Which renter is set to charge automatically is a setting in your software. Export that list before you cancel anything.
- Invoice and payment history. A separate import from the old software, with its own scope. Ask what your new vendor takes and what it drops.
- Cards created mid-move. Adyen recommends asking the old provider for tokens created during the switchover, and Braintree caps you at two imports: the bulk load, then one catch-up for customers added while processing moved.
- ACH authorizations. Nacha requires you, as the Originator, to give the customer a copy of the authorization and to produce proof of it to your bank on request. Bank details moving between processors does not move that obligation.
Expired cards mostly fix themselves
Visa Account Updater exists for this. When an issuer reissues a card, it files the new number and expiry date with VAU, and a merchant querying through its acquirer gets the update back, along with closed-account advices and contact-cardholder advices. It covers account number changes, expiry dates, closures, and product or brand conversions.
Mastercard runs the same idea as Automatic Billing Updater, returning account and expiry changes to registered card-on-file merchants through their acquirer before authorization.
Worth asking every vendor on your shortlist whether your account is registered for both. An operator running 300 units on autopay who is not enrolled is re-collecting cards every time a bank reissues plastic.
Switch self storage software in the right order
- Ask your current processor, in writing, for its data release terms. Everything else depends on that answer.
- Get the new processor's Attestation of Compliance, or find its Visa Global Registry listing.
- Request the export before you give notice on anything.
- Cut over just after a billing run, so a full cycle passes before the next charge.
- Run a real charge on the new processor before you close the old merchant account.
- Keep read-only access to the old system for a few months, for the first dispute that arrives from before the switch.
What to ask each vendor
Six questions, and the answers should come without a callback:
- Which processor do you use, and can it receive a transfer from mine?
- Who files the paperwork, you or me?
- How do the new tokens get matched to my renters?
- What happens to cards that match nobody?
- Can renters add and update their own card without calling the office?
- How do I see who is on autopay the week after we go live?
They belong on the same sheet as the demo tasks you give every vendor.
How the matching works in Smart Storage Software
Card processing runs through Fortis. When transferred data lands, the cards arrive as tokens attached to nobody, and our token mapping screen lists them with a renter already suggested for each one, matched on cardholder name. You confirm rather than type. Anything the name does not match, you pick from the renter list.
Renters who still need to re-add a card do it in their own portal, where the card vault and autopay settings live. The Auto-Pay Enrollment report shows who is enrolled after go-live, and Card Expiration Dates shows whose card lapses next.
Start with the email to your current processor asking for its data release terms. Nothing else in this list can move until that answer arrives.
Questions operators ask before moving their card data
Can my software vendor send me the card numbers?
No, and you should not want them to. Card data moves processor to processor under PGP encryption. Stripe will only send it to a PCI DSS Level 1 processor that can show a current Attestation of Compliance or a listing on the Visa Global Registry.
How long does a card migration take?
Stripe publishes a 10-day service level for completing a migration once it has all the valid data. Adyen tells merchants to expect 10 days or more. Request it before you give notice, not after.
Does the transfer bring my payment history?
No. Braintree states plainly that it can import customers and payment methods but cannot migrate subscription or transaction information. Invoice and payment history is a separate import from your old software.
What happens to cards that expire during the move?
If you are registered for Visa Account Updater and Mastercard Automatic Billing Updater through your acquirer, reissued numbers and new expiry dates come back automatically. Ask the new vendor whether you are enrolled.
What if my old processor refuses to release the data?
Check your processing agreement for a data release clause first. Without one you are re-collecting cards by hand, so start the conversation early and get the answer in writing.
