3 ms·
How does Stripe mitigate PCIDSS requirements?
by lotsofcows 14y ago
How does Stripe mitigate PCIDSS requirements?
- jeremyjh 14y agoThe card number never hits the merchant's web server, so currently they do not have to be compliant. There is talk in the industry that this will be changing actually; as the card number is still vulnerable to javascript that run's in the merchant's web page. So if the merchant is hacked and their website is compromised then CC numbers are vulnerable. So it is likely at least some of the applicable PCI DSS requirements (and auditing of them) will eventually be required.
- lotsofcows 14y agoAnyone who takes credit card payments must be PCIDSS compliant. How the payment's taken is irrelevant. Presumably Stripe reduces this to the level of completing the SAQ A?
- jusben1369 14y agoThat's the right way to explain it Yes.