All Collections
Stripe
Is Stripe secure? Will I be PCI-compliant?
Is Stripe secure? Will I be PCI-compliant?

Yes. Stripe is certified to PCI Service Provider Level 1 – the highest level of certification available.

Roohbir Singh avatar
Written by Roohbir Singh
Updated over a week ago

Yes! Stripe meets and exceeds the most stringent industry standards for security. Stripe is also audited by a PCI-certified auditor, and is certified to PCI Service Provider Level 1. This is the highest level of certification available.

To clarify, Paythen, or any human never sees or stores any sensitive customer payment data – this is handled directly by Stripe, through our integration. That means your customer data is safe & secure with some of world's leading security.

You can learn more about the technical details of Stripe’s secure infrastructure here. You can see Stripe’s PCI certification on the Visa Global Registry of Service Providers.

We've highlighted some of the key security info here:

HTTPS and HSTS for secure connections

Stripe forces HTTPS for all services using TLS (SSL).

  • Stripe.js is served only over TLS

  • Stripe’s official libraries connect to Stripe’s servers over TLS and verify TLS certificates on each connection

Encryption of sensitive data and communication

All card numbers are encrypted at rest with AES-256. Decryption keys are stored on separate machines. None of Stripe’s internal servers and daemons are able to obtain plaintext card numbers; instead, they can just request that cards be sent to a service provider on a static whitelist. Stripe’s infrastructure for storing, decrypting, and transmitting card numbers runs in separate hosting infrastructure, and doesn’t share any credentials with Stripe’s primary services (API, website, etc.).

Did this answer your question?