Payment credential storage is where casino apps quietly diverge in quality. Two apps can share the same lobby design and the same game supplier list, yet handle your card data in completely different ways behind the glass. On iOS, the Casushi app leans on a tokenised cashier flow unlocked by Face ID: raw card numbers never land on the handset, and the payment token that does get stored lives in the iOS Keychain and is invalidated after each session. That last detail matters more than most players realise, and it is the thread this deep-dive pulls on.

What tokenisation actually changes inside the cashier

Tokenisation replaces your 16-digit card number with a surrogate value that the payment processor can map back to the real card. The app never sees the PAN after the first setup. Instead, Apple’s payment stack, the acquiring bank and the processor exchange a device-specific token, and the Casushi app cashier manages payments by passing that token through rather than a card number. If someone extracted the token from the device, it would be useless outside the bound merchant and device context.

The practical consequence is that a compromised handset does not automatically mean a compromised card. A thief who gains file-level access to an iPhone finds a token with a narrow scope, not a card number they can type into another site. That is the core trade-off of tokenised payments: slightly more setup friction on the first deposit, substantially less blast radius if the device is lost or jailbroken.

It also changes what the casino itself holds. Because the token is bound to the device and the merchant, Casushi’s servers store a reference rather than a recoverable card number. Card update events, such as a reissued card or an expiry change, flow through the token lifecycle rather than requiring you to re-enter details manually every time.

Where the token lives on an iPhone

The token sits in the iOS Keychain, Apple’s encrypted credential store, which is itself protected by the Secure Enclave. Access to a Keychain item can be gated behind biometric authentication, which is exactly how Face ID fits into the flow. When you open the cashier and confirm a deposit, Face ID unlocks the Keychain item, the token is released to the payment request, and the transaction completes. The token is then invalidated after the session ends, so the next deposit requires a fresh biometric unlock rather than reusing a lingering credential.

This session-scoped invalidation is the part worth dwelling on. Many apps keep a payment token alive indefinitely so returning users can deposit in two taps. Convenient, but it means a stolen unlocked phone is a stolen wallet. Invalidating after each session trades a second of Face ID for a meaningfully smaller window of exposure. Apple users download the Casushi app from the App Store to get this flow; the biometric gate is not bolted on afterwards, it is the mechanism that releases the credential.

How the iOS and Android paths diverge on credential handling

The contrast with Android is instructive. Casushi does not publish a standalone Android APK file, so Android users access the Casushi site through a mobile browser, typically Chrome. A browser-based cashier can be perfectly secure in transit, but it operates under different storage rules. https://casushi-online.uk/app/ offers additional context worth reviewing. Chrome may cache form data, autofill profiles can retain card fragments, and the browser’s own password and payment managers sit outside the casino’s control. None of that is a flaw in Chrome; it is simply a different threat model from a native Keychain-bound token.

On iOS the app controls the storage boundary. On Android the browser does, and the casino can only ask it nicely to forget things. That is why the Casushi mobile site offers responsible play tools and a solid responsive layout but cannot promise the same session-scoped token invalidation a native iOS build delivers. The responsive site detects screen dimensions automatically and serves a clean lobby, but credential handling remains the browser’s domain.

This is not an argument that Android play is unsafe. It is an argument that the two platforms answer a different question. iOS asks “can I prove it is you before releasing a scoped token?” Android browser play asks “can I complete the transaction without storing anything sensitive in the first place?” Both are reasonable; only one involves a hardware-backed biometric gate.

• iOS app: payment token stored in the Keychain, released by Face ID, invalidated after each session.
• Android browser: no Keychain equivalent, so Chrome’s own form caching and autofill rules apply.
• No Android APK: sideloaded builds bypass store review, which is why Casushi does not distribute one.
• First-deposit setup: token provisioning happens once, then each session needs a fresh biometric unlock.

Practical habits that keep the flow tight

The security model only works if you use it as designed. Keep Face ID enabled for the app and resist the temptation to disable biometrics for convenience; the token release depends on it. If you share the device, use iOS’s own app-level lock so the cashier cannot be opened without your face. And treat push notifications as a monitoring tool rather than noise: deposit confirmations arriving on the lock screen are an early warning if someone else is using your account.

On the Android side, review Chrome’s autofill settings and clear saved payment data if you deposit from a shared browser. The Casushi mobile site cannot invalidate a token it does not hold, so the caching boundary is yours to manage. Whichever platform you use, the welcome offer and mobile lobby are the same; the difference is entirely in how the cashier handles your credentials. The Casushi app supports Face ID logins precisely because the biometric check and the token release are the same event, and keeping that event intact is the single most useful habit you can adopt.

One more piece of housekeeping: this website operates as an information page only, so always confirm deposit mechanics inside the Casushi cashier itself before committing funds. If you want the tokenised, session-invalidated flow described here, the App Store listing is the only legitimate route to the iOS build. Android players get a capable browser experience, but they should understand the caching trade-off going in. Match the platform to your risk appetite, keep biometrics on, and the payment layer stays boring, which is exactly what you want from it.