How do I legally become PCI compliant and use Stripe?

Question

I'm new to PCI and would like to use Stripe as my payment gateway. They don't charge monthly fees, and have a good php system to send funds from site to Stripe. Right now I know I can allow customers to put in their card information, use Stripe's framework, and allow the card information disappear. That's fine but my question is:

If I want to store card information in a database for using in Stripe's PHP framework, how do I learn to do it legally?

This question appears to be off-topic because it is about legal financial requirements. — Greg Hewgill, Oct 09 '14 at 01:34

Whatever Man · Accepted Answer · 2014-10-09T01:55:01.697

7

If you use their Stripe Javascript client to send credit card information to them, what you'll be storing in your database will be a token which represents the client and their credit card, not an actual credit card. If you then ensure that the page where you collect the credit card info is served over HTTPS, you should be PCI compliant.

Using Stripe.js

Being PCI compliant using Stripe

edited Oct 09 '14 at 01:55

answered Oct 09 '14 at 01:35

Whatever Man

506
7
21

Thanks, this should be good information. – user2296112 Oct 09 '14 at 02:48

Aydin · Answer 2 · 2014-10-09T01:42:04.840

3

Why would you ever want to do that though?

The beauty of any payment gateway is that you don't have to bother or worry about storing your customers sensitive data, instead you integrate the API with your data layer and consume it as if it was right out of your database.

Stripe provides you with everything you need, their API is very well documented so there really isn't any reason to not be using it in the way I just described.

edited Oct 09 '14 at 01:42

answered Oct 09 '14 at 01:34

Aydin

15,016
4
32
42

1

This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. – Khanh Nguyen Oct 09 '14 at 02:55
@KhanhNguyen It does. `If I want to store card information in a database for using in Stripe's PHP framework, how do I learn to do it legally?` And my answer was to never store it because there were much better options, I've also pointed him in the right direction to what he should be doing instead. – Aydin Oct 09 '14 at 03:05
1

You'r right. My bad. – Khanh Nguyen Oct 09 '14 at 04:31

score 0 · Answer 3 · answered Oct 09 '14 at 01:36

The simplest way to stay PCI compliant is to never store any card information in any database. Stripe can store the card information for you by using a customer, and attaching card(s) to those customers. You easily access these customers then and charge their card. All you need in your database are the customerId's which keeps you from getting into any PCI issues.

How do I legally become PCI compliant and use Stripe?

3 Answers3