How Ramp Scales Card Issuing Without Scaling PCI Scope

Not every API call can finish in seconds. Some calls wait on a card network, a partner integration, or a query against a large dataset—and that’s normal.

Yet, somewhere in Ramp’s card flows, single API calls were running past what a fixed timeout allowed. The cause varied, but the outcome didn’t: the system gave every call the same limited window to finish, and when a call ran past it, the call simply failed, regardless of how close it was to completion.

For Arnold Lin, a staff software engineer on Ramp’s security team, this fixed timeout window created a ceiling that was more than a minor inconvenience.

“It was a painful way to support long-running API calls,” Lin described.

That same workflow can run asynchronously today without workarounds because Ramp runs its card-issuing tokenization through Basis Theory.

Fixing Card Booking at Scale

The search for a data tokenization provider stemmed from a desire to keep pace with an increasingly complex set of card flows. Card issuing, third-party booking, and card usage weren’t use cases that could all be handled by a one-size-fits-all API.

Lin and his manager, Eli Block, Head of Security + Foundations Engineering, evaluated vendors to replace an existing tokenization provider. Migrating Ramp’s entire database over to another provider was a non-starter for a security team that wanted a better vault, not a full-scale data migration.

It came down to meeting a short, but critical, list of requirements:

1. Easier management of tokens with proper access controls and expirations.
2. Developer experience that wasn’t a fight at every turn.
3. A feature set that can help Ramp scale its card issuing and third-party booking use cases.

Lin pointed to Basis Theory’s Secure Reactors, and being capable of supporting longer-running API calls in ways the prior setup couldn’t.

“Basis Theory’s developer experience is really great, and the customized billing model is really helping us,” Lin says. “That, plus the ease of integrating with our existing providers, is what I was looking for.”

Implementing with AI in the Loop

Once a decision was made, Ramp implemented Basis Theory in less than a quarter as a data tokenization provider. Lin says the engineering team effectively used AI to interact with Basis Theory’s documentation.

“The totality of Basis Theory, from the documentation, AI-assisted development, the whole suite, it’s a really good toolbox to get new work developed,” Lin says.

That same documentation remains useful on a day-to-day basis. With AI tools, Basis Theory’s documentation becomes something Lin can query, rather than search manually. Lin points to using AI for incident response.

“No need to track down which specific page applies; it’s very capable of working out a possible solution,” Lin says. “What used to take an hour of troubleshooting can now be done in 15 minutes.”

Updating configuration or proxies used to require going through documentation to find the exact call names.

“With the AI’s help, I can ask it to do something, and Basis Theory’s documentation is good enough to support any of the possible use cases,” Lin says. “That slashes development time from days to hours.”

Keeping the Human Element

Today, Lin explains that Secure Reactors are doing most of the heavy lifting to support the Ramp use cases. Card issuing, receipt capturing, and card usage through third-party vendors run as core, ongoing workflows. Managing these features consistently isn’t necessary.

“Our engineering team found the API documentation comprehensive, and Basis Theory engineers have super response times,” Lin says. “There’s no back-and-forth email, no painful ticket queue, no guesswork. We can work through Slack.”

The Secure Reactors let Lin bring his own logic and custom dependencies into the process, tailoring Basis Theory to Ramp’s specific flows. The same long-running calls that used to fail outright now just run.

The reliability gains show up in what no longer happens. Lin says that Basis Theory’s approach led to lower “flake rates” and higher success rates across the board. And there’s no cap on reading data in bulk, or PCI compliance questions to answer each time.

“Basis Theory just works,” Lin says. “Development can get unblocked while Ramp pursues a higher level of PCI compliance."