I am creating a payment processing page for use via stripe and I want to be able to have my customers manages saved cards or use a new one. I am worried about being too forthcoming with some customer information and the possibility of exposing too much card information to my servers.

If I retrieve sensitive info like last 4, exp date, etc. should I be putting some means of encryption on it or is it completely fine to display or store pieces of that information for relationships server side on my end?

EDIT: New dev here be gentle :)

up vote 0 down vote accepted

The only PCI-sensitive information is the entire card number and the CVC.

The card's brand, last 4 digits and expiry date are not sensitive. If you use Stripe, you can retrieve this information the card object's attributes, e.g. exp_month and exp_year, etc.

From a PCI compliance point of view, you don't need to do anything special to handle this data since it is not considered sensitive. My recommendation would be to either simply query the information from Stripe as needed, and discard it afterwards, or store it as-is into your database (in that last case, you'll probably want to use webhooks to make sure your DB is synced with your Stripe account).

  • Thanks for the info! – Alex Rohr Jul 25 '16 at 14:17
  • 2
    Well its still card holder data and subject to PCI compliance, but the PCI compliance necessary for that level of information AND using Stripe.js or Stripe Checkout is PCI SAQ A compliance, which with Stripe means just having an SSL certificate. – Matthew Arkin Jul 25 '16 at 17:40

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.