3 ms·
> You should NEVER have the user enter credit card information on your site My app client sends the card info to Stripe, then forwards the Stripe token to my s
by MarkMc 10y ago
> You should NEVER have the user enter credit card information on your site
My app client sends the card info to Stripe, then forwards the Stripe token to my server to charge the card each month. So far this is a standard security model.
The problem is that if PayPal come along to offer me a cheaper commission on processing subscription payments, I cannot simply switch my sever to use PayPal for all my existing customers. So I'm tempted to encrypt the credit card info and store it in my database in case I want to switch in future.
- mrweasel 10y agoI don't know about PayPal, but even if you just have the token for recurring payments/subscriptions you can still switch PSPs. Most PSPs are able to exchange tokens and information, enabling you to switch between them (at a price of cause).
- teh_klev 10y ago> "So I'm tempted to encrypt the credit card info and store it in my database in case I want to switch in future." Seriously....just don't. The world of pain you'll be in if you mishandle this data and the symmetric encryption key will probably see you or your clients made bankrupt. Please read up on PCI-DSS before even considering this: https://www.pcisecuritystandards.org/document_library https://www.pcisecuritystandards.org/document_library