> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reap.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Two ways to reveal a card's PAN, CVV, and expiry, and how to choose between them.

A card's full details (PAN, CVV, expiry date) are sensitive data that Reap holds on your behalf. There are two ways to get at them, and the right one depends on whether the values need to reach your own systems.

***

## Choosing an approach

|                        | [Secure Display](/cards/card-details/secure-display) | [Encrypted Retrieval](/cards/card-details/encrypted-retrieval) |
| ---------------------- | ---------------------------------------------------- | -------------------------------------------------------------- |
| **What you get**       | A short-lived URL you render in an iframe            | An RSA-encrypted payload you decrypt                           |
| **Where details land** | Only in the cardholder's browser or app              | On your backend, in plaintext after decryption                 |
| **PCI DSS scope**      | Stays with Reap                                      | Moves to you                                                   |
| **Availability**       | Every program                                        | Off by default, enabled after a compliance review              |

**Start with Secure Display.** It covers the common case: showing a cardholder their own card details in your app. Raw card data never enters your systems, so your PCI DSS obligations do not change.

**Use Encrypted Retrieval only when the raw values must reach your backend** and your environment is already PCI DSS compliant. Reap reviews your compliance status before enabling it per program. Projects without it receive `403 PAN_REVEAL_NOT_ENABLED`.

The two are not exclusive. A program approved for Encrypted Retrieval can still use Secure Display for its in-app reveal, and most do.

***

## What both have in common

* **The card must be usable.** It has to exist, not be in a terminal or inactive status, and belong to an active account.
* **Authenticate the cardholder first.** Neither approach checks who is asking beyond your API key, so verify the user's identity in your application before revealing anything.
* **Treat the output as short-lived.** Do not cache, log, or persist reveal URLs or decrypted values.
* **Every retrieval is audited** by Reap.