search

ezet / stripe-sdk

A simple and flexible Stripe library for Flutter with complete support for SCA and PSD2.
https://pub.dev/packages/stripe_sdk
Other
137 stars 137 forks source link

By using this library will have a PCI Compliant payment integration ? #86

Closed GyuriMajercsik closed 4 years ago

ezet commented 4 years ago

I think that depends on your implementation. If any sensitive information, such as card-data, is ever sent to your server, your system will probably have to comply with the full PCI regulation. If you only collect card-details locally on the device, and can guarantee that these details never leave the device except for the call to Stripe to obtain a token, you are likely PCI compliant. If in doubt, I recommend contacting Stripe directly.

GyuriMajercsik commented 4 years ago

Thanks @ezet for the fast response.

I believe you can't get a SAQ A validation, which is the simplest way to be compliant.

Based on Stripe documentation from https://stripe.com/docs/security/guide#validating-pci-compliance:

Stripe’s mobile SDK development and change control is done in accordance with PCI DSS (requirements 6.3 - 6.5) and is delivered via our PCI validated systems. As such, we advise our users to rely on UI components from our official SDKs for iOS or Android, or to build a payment form with Elements in a WebView, to be eligible for the simplest form of PCI validation: SAQ A. If you only use our mobile SDKs or an Elements-based WebView, you can inform your PCI auditor that card numbers pass directly from your customers to Stripe.

Should you do otherwise, such as writing your own code to handle card information, you may be responsible for additional PCI DSS requirements (6.3 - 6.5) and not be eligible for an SAQ A. In this case, we’d suggest you reach out to a PCI Qualified Security Assessor (QSA) to determine how best to validate your compliance according to the current guidance from the PCI Council.

ezet commented 4 years ago

Well, it says you may be responsible for additional PCI DSS requirements, and I think this depends on the actual implementation. I think the critical factor is whether you can guarantee that the information never leaves the device, except for the request to Stripes PCI DSS compliant servers. In this case, it's important to also consider any kind of logging, crash reports and so on. But Stripe does offer help in this regard, so I suggest contacting them.

GyuriMajercsik commented 4 years ago

Thanks for your input on this.