New answers tagged compliance
(Disclosure, I work for Braintree, a competitor to Stripe) At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from storing the CVV. You are allowed to hold the code temporarily while waiting for the charge to be authorized. This is stated in PCI-DSS Requirement 3.2 (additional ...
Top 50 recent answers are included