Hacker News Reader

Comment by abcd_f | Hacker News Reader

I was under the impression that if my website is asking for a credit card number that is later used for a transaction, then it needs to be PCI compliant. Perhaps, it is a Canadian specific, but this need for the PCI compliance is the major selling argument in favor of hosted payment services.

And on a related note - is Stripe available outside of the US?

(edit) Ah, found it.

  > Do I need to be in the United States to use Stripe?
  > Yes.

Damn. Bummer.

View on HN

The exact details of PCI are pretty complex, but, roughly the answer is that any system that touches credit card numbers has to be PCI compliant.

This means that if you take credit cards on your website, you need to be PCI compliant. But the exact requirements differ depending on your setup, and what Stripe helps you do is ensure the credit card information never hits a server owned by you. This drastically reduces the scope of your compliance to a simple questionnaire.

As for being outside the US, not quite yet. We're working hard on that front though, so stay tuned.

I was first going to say how's that the CC #s from my web form are not hitting my server, but then looked at your Docs - and what you did is ingenious - the form is mine, but it is submitted to your site.

The curl example on the front page is rather misleading. It was the only thing I actually read through on that page and I walked away with an impression that that code snippet needs to go to my server. Just the 2c worth of UX feedback :)

Thanks for the feedback. We'll work on clearer examples.

I'm not sure I understand the PCI implications of using the API. If I use the Create a New Charge example on the homepage in my code, aren't the credit card details going through my server?

*Edit: Nevermind. After reading through the API, I learned you can use a token instead of the card details.

Reply on news.ycombinator.com