Payment security & PCI compliance

What PCI compliance means for your business, how using Stripe or PayPal keeps you safe, and simple steps to protect your customers' payment data.

If you accept card payments, you have probably heard the term "PCI compliance." It sounds intimidating, but for most small businesses using modern payment processors, the heavy lifting is already done for you. This guide explains what it means and what your responsibilities are.

Quick summary

PCI DSS is the security standard for businesses that handle card payments. Using a reputable processor like Stripe or PayPal means card data never touches your servers — they handle the secure parts. Your main responsibility is to use strong passwords, keep your software updated, and not store card numbers anywhere on your own systems.

What PCI DSS is

PCI DSS stands for Payment Card Industry Data Security Standard. Stripe describes it as "the global security standard for all entities that store, process, or transmit cardholder or sensitive authentication data." It is maintained by the PCI Security Standards Council, an industry body that develops payment data security standards.

Anyone involved in processing, transmitting or storing card data has to comply with it. What happens if you do not is set out in your agreement with your processor — and in the event of a breach, the financial and reputational damage is the bigger problem.

The good news is that most small businesses using a hosted payment processor are in a very good position without doing much extra work.

How Stripe and PayPal handle compliance for you

When you use Stripe or PayPal's hosted checkout tools, the customer's card details are entered directly into a form or page that Stripe or PayPal controls — not your website. This means:

Raw card numbers never pass through your server. Your website never sees, stores, or touches the card data.
Both carry the compliance load for the card data. Stripe is certified every year by an independent PCI Qualified Security Assessor as a PCI Level 1 Service Provider, the top tier. PayPal's online payment services agreement commits PayPal to meeting the PCI DSS requirements for the cardholder data it handles on your behalf, and makes it responsible for the security of that data.
Your compliance scope is significantly reduced. You are responsible for securing your own systems, but you are not responsible for the card data itself.

Stripe puts the reason plainly: a business that handles sensitive card data directly may have to meet more than 300 PCI DSS security controls, while an integration that sends card details straight to Stripe without passing through your servers reduces your PCI obligations instead.

Your responsibilities

Even though Stripe and PayPal handle the hard parts, you still have obligations:

1. Never store card numbers yourself. Do not write down or save card numbers, CVVs, or full track data anywhere — not in a spreadsheet, not in an email, not in a note. If you need to charge someone again, use your processor's stored payment methods feature.

2. Keep your website software updated. An outdated WordPress installation or plugin can be exploited, even if card data is hosted elsewhere. See WordPress updates explained and Keeping your store secure.

3. Use strong, unique passwords. Protect your processor dashboard (Stripe, PayPal) with a strong password and two-factor authentication. See Strong passwords and Two-factor authentication explained.

4. Only give access to people who need it. Do not share your Stripe or PayPal login with everyone in the business. Use role-based access to limit who can see payment data.

5. Attest to your own compliance. Stripe's position is that PCI compliance is shared: it handles its side, and you must accept payments in a PCI-compliant manner and attest to that every year. Your Stripe Dashboard shows the documentation your particular business has to provide, which for most hosted-checkout setups is a short Self-Assessment Questionnaire (SAQ) rather than an audit.

Do not accept card details by email or phone without guidance

If a customer emails you their card number, you become responsible for securing that data. Do not store it. Instead, send the customer a Stripe payment link so they can enter their details securely. Talk to us if you regularly take payments over the phone — there are proper tools for this.

SSL (HTTPS) and payment security

Your website should use HTTPS on every page, and must on checkout pages. HTTPS encrypts the connection between your visitor's browser and your website. You can confirm it by checking that the address in the browser bar starts with https://.

Stripe's own rule is that payment pages have to use a recent version of TLS — 1.2 or above — and that every interaction between your server and Stripe uses HTTPS. Stripe lets you test an integration without HTTPS and turn it on before you accept live charges. See What is SSL & HTTPS? for more detail.

Fraud prevention tools

Both Stripe and PayPal include built-in fraud detection. Stripe's tool is called Radar. Stripe screens every transaction against Radar's default rules, which are built on its own AI models: the highest-risk payments are blocked outright and elevated-risk ones are flagged for review.

You do not need to configure anything for that screening to happen. Writing your own rules — for example, blocking payments from cards issued outside your country — is a separate matter: Stripe only offers custom rules in the Dashboard if your Radar plan includes them. The Radar that comes free with standard payments pricing does not; the plans that do are paid subscriptions, so check Stripe's Radar pricing for which plan covers what.

Common questions

Do I need to pass a PCI audit?

Most small businesses using hosted payment tools (Stripe, PayPal) qualify for a self-assessment rather than a formal audit. The self-assessment is a questionnaire, not an on-site inspection. Your processor will tell you which SAQ applies to your situation.

What happens if my site is hacked — am I liable for card fraud?

If card data was stolen from your systems, you could face fines, liability, and reputational damage. This is why keeping your software updated and avoiding storing card data are so important. With a hosted processor and no card data on your server, a hack of your website does not expose card numbers — only your own customer records and site content.

What is tokenization?

Tokenization is the process by which Stripe (and other processors) replace a card number with a unique token — a meaningless string of characters that represents the card. Your website never has to hold the actual card number: what comes back to your systems is the token plus a few non-sensitive details, such as the card type, the last four digits and the expiry date. If someone accessed your database, they would find tokens that are useless without access to Stripe's systems.

Does PCI compliance cost money?

Not with Stripe's standard pricing, which carries no monthly charge of any kind: in Stripe's own words, "Stripe does not charge setup fees, monthly fees, or any other hidden fees like closure fees." Some other processors do bill a monthly "PCI compliance fee" — that is their own charge for the support they give you in meeting the standard. Check your processor's statement for any such line items.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.