PCI Security Compliance (Tokenization with Stripe Elements?)

Hi @maltfield ,

Thank you for reaching out to us. To address your concern, we want to assure you that sensitive payment information (such as credit card numbers) never passes through your server. Here’s how our plugin handles payment information:

1. Client-Side Tokenization : Our plugin utilizes Stripe’s JavaScript library (Stripe.js) to handle sensitive payment information directly in the customer’s browser. The credit card details are sent directly to Stripe’s secure servers, bypassing your server entirely.
2. Token-Based Transactions : After the payment information is processed by Stripe, a token is generated and sent to your server. This token is used by your server to interact with Stripe’s API for creating charges or managing subscriptions.
3. No Sensitive Data on Your Server : Only the token, not the actual credit card details, is stored or processed on your server. This ensures that your server remains outside the scope of PCI compliance. The token represents the payment information, which is securely stored on Stripe’s infrastructure.

In summary, the plugin ensures that sensitive payment information is never stored or processed on your server, keeping your infrastructure out of PCI scope.

Additionally, we do use our server between Stripe and the client’s server, but this is strictly for the purpose of refreshing tokens:

• Domain : verify-stripe.webtoffee.com
• When refreshing tokens, the client’s site sends the refresh token and account ID to the WebToffee server. From there, a request is made to Stripe to get a new access token, refresh token, and publishable key.
• The response is sent back to the client site.
• The domain verify-stripe.webtoffee.com is registered at the Platform account of WebToffee.

Important Note : Payment-related requests are not handled via our server; it is only used for token refreshing and relaying responses.

If you have any more questions or need further clarification, feel free to let us know!