5

Following their tutorial, Stripe allows to save customer and charge them later.

But, does one have to be PCI compliant? In their API Reference, it seems they give lot of information to be stored which seems to be a security risk. If someone gets hold of my API key and customer information, can they misuse the information?

1 Answer 1

5

Taking advantage of a service provider, like Stripe, to store cardholder data is a way to simplify your PCI requirements. However, with any solution there are trade off and other requirements you must keep based on the solution you choose. Just because you use someone like Stripe doesn't mean you have no PCI compliance requirements. In the case of using a tokenization solution you need to protect the tokens from being exchanged for the represented data. This means, from a PCI perspective, the system storing the tokens shouldn't have the knowledge (meaning API keys and/or API Auth data) or the ability (no direct access to the API, etc.) to exchange the tokens back to card data.

After looking at the API docs from Stripe it appears they are pretty good about not allowing you to retrieve the credit card number from a token or customer. Looking at the official API docs on CARDS and CUSTOMERS, you listed, it shows that the actual card number is NEVER returned when a CUSTOMER or CARD object is retrieved. So the exposure is limited. Someone could still get valuable information about your customers that you don't want them to have. That is why PCI still requires you to protect the tokens as well as API keys as sensitive data and secure them accordingly.

The PCI guide for Tokenization should be pretty helpful and goes into more detail about what I mentioned above.

PCI DSS Tokenization Guidelines

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .