Security
PCI DSS
The Payment Card Industry Data Security Standard applies to systems that store, process or transmit cardholder data. The shortest way to satisfy it is to make sure none of your systems do — which is the route we took.
When you add a payment method, the card number is typed into a field that Stripe serves and sends straight to Stripe. Our code never reads it, our database never stores it, and nothing in our logs could contain it.
What we carry
- Card fields served by Stripe
- The Console mounts Stripe’s Payment Element, which renders inside a frame Stripe controls. We receive a confirmation that a payment method exists, never the number behind it.
- No cardholder data at rest
- There is no column for a card number, so there is nothing to encrypt, nothing to leak and nothing to audit.
- Stripe as the certified processor
- Stripe is named in our sub-processor list for payment processing, and the certification that matters for card data is theirs to hold.
What stays with you
- Your own product’s payments
- If your application takes cards, that is your scope and your assessment. Using nulvless for identity does not change what your checkout touches.
- What you put in metadata
- Fields you control are yours to fill. Card numbers do not belong in user metadata, custom claims or any field we hold on your behalf.
Related
We have not completed a self-assessment questionnaire. The description above is what the implementation does; the paperwork that would turn it into a formal attestation is not done yet, and we will not call it one until it is.