Configuring Stripe Gateway

[MineHarvest66]

Hello, just so I understand correctly... 

As long as I have token "offsite" storage option ticked, even though that the customer has to enter his/her credit card details on my Blesta's install it won't be stored? Even if he/she tick the "save payment" check box towards the bottom? 

Or I am doing something wrong by allowing credit card payments within Blesta with that setup?  

Thank you very much in advance. 

[MineHarvest66]

According to https://stripe.com/docs/security#pci-dss-guidelines it seems that it very insecure on how this module is built if I am not mistaken...  

Quote

Requirement: SAQ D
We strongly discourage passing card information directly to Stripe’s API as it means your integration is directly handling card information. Even if you do not store any payment information, we can only help simplify PCI compliance if you’ve integrated with Checkout, Elements, or our mobile SDKs.

 

Quote

If you continue to send card details directly to our API, you’ll be required to upload your SAQ D annually to prove your business is PCI compliant. SAQ D is the most onerous of all the SAQs, with over 40 pages of requirements you must implement to remain PCI compliant. We highly recommend you migrate to client-side tokenization of card information to substantially reduce the scope of your PCI compliance.

Honestly why is this module not up to standards??

[Beav]

http://dev.blesta.com/browse/CORE-1085

 

Lots of good talk on pci compliance here for stripe

[MineHarvest66]

46 minutes ago, gosuhost said:

http://dev.blesta.com/browse/CORE-1085

 

Lots of good talk on pci compliance here for stripe

Very interesting thank you very much for sharing.