> Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number This is true, bu

> Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number This is true, but it's also kind of a misleading statement; the original selling point was that you could accept credit cards without having to deal with the requirements of PCI compliance and merchant accounts, which is done (partially) by you not ever seeing the card data. If there was similar compliance regulation around document storage, I would assume that Stripe would use "Identity-Document-Standards" compliancy as a selling point. As far as I know, there are no such requirements. I do think your #2 point though is exceptionally valid, and would hope that the majority of Stripe keys are scoped to not even provide access to this data/endpoints. Edit: grammar