Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to the Stripe FAQ, they are PCI-compliant. Also, in their API documentation, one of the parameters to create a new card is the CVC (although, granted, it is optional). So, I assume they store the CVC for subsequent credit card transactions. But the PCI DSS strictly forbids you to store CVV, CVC etc.

So how can they be PCI-compliant?

share|improve this question
I think your assumption is incorrect. I think it's far more likely that they use it for an initial verification, and do not store it. If they've proven that you know it the first time, there's not even any reason to store it. Quite the opposite in fact. If they ever felt the need to reverify, they would want the user to provide it again, not pull it from their own system. –  Xander Aug 29 '13 at 18:05
Ok, but Stripe is just a payment gateway. They still need to send the CVV to their acquirer when making a transaction. And ultimately, it's not Stripe who decides whether the user knows or does not know the CVV; it's the credit card issuer, right? What am I missing? –  Otavio Macedo Oct 1 '13 at 16:23
Even so, they still shouldn't need to send it for every transaction. They're going to send it initially, and the processor will then send them a token back that they can use for future transactions, just as your app would get if you were dealing with the payment processor directly. So all Stripe needs to do is forward the card information to the processor to confirm validity, and then they need to store the token they get back, but not the raw card data. Does that make any more sense? –  Xander Oct 1 '13 at 16:38
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.