The PCI council has already provided the evidence for which I've already provided the link. Read the PCI guidance surrounding tokenization. It makes it very c

The PCI council has already provided the evidence for which I've already provided the link. Read the PCI guidance surrounding tokenization. It makes it very clear. Just think about this rationally for a second. If you are a merchant who uses a bit of JavaScript provided by a payment provider and customers enter their credit-card information into the form created by that JavaScript, but instantiated by an HTTP response from the same origin of your domain how do you as a merchant side-step responsibility for PCI compliance? The simple fact of the matter and as outlined in the latest PCI guidance, you don't. Now if you instead send your customer directly to Stripe and they collect the credit card information within their same origin, then yes, PCI side-stepped. Stripe and any other vendor in this space need to behave responsibly and ensure their customers understand their PCI responsibilities.