boatyang

Hi Maltfield,

Short Answer: NO – Our plugin does not expose your server to customer payment information, and your server remains outside the scope of PCI DSS compliance requirements.

Technical Details:

1. No Sensitive Data on Your Server: Our plugin never processes, transmits, or stores sensitive payment data (credit card numbers, CVV, etc.) on your WordPress server. All sensitive payment information flows directly from the customer’s browser to Stripe’s PCI-compliant infrastructure.
2. Two Implementation Methods:
   • Stripe Checkout (Redirect): Customers are redirected to Stripe’s hosted checkout page, so sensitive data never touches your domain
   • On-Site Forms with Stripe Elements: When customers enter payment details on your site, we use Stripe.js and Elements, which securely transmit data directly to Stripe via encrypted connections. Your server never sees the raw payment data.
3. Tokenization: Any payment references stored in your WordPress database are tokenized identifiers provided by Stripe (like payment intent IDs or customer IDs), not actual payment data.
4. PCI Scope: Because sensitive payment data bypasses your server entirely, your infrastructure falls under Stripe’s PCI compliance umbrella rather than requiring your own PCI certification.

Important Note: While our plugin keeps you out of PCI scope for payment data, you should still follow general security best practices for your WordPress installation and ensure you’re compliant with other data protection regulations (like GDPR) for any non-payment customer data you collect.

Hope these information helps.

Best

Nice finding! We have make up the missing tag for v1.13.12 and also released the latest v1.14.0 with tag as well.